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Description 

The present invention generally relates to a control 
system and more particularly to the control system im- 
parted with diagnosis function. 

In general, the control system to which a great im- 
portance is put is implemented with redundancy by mul- 
tiplexing the control in an effect to enhance the reliability 
of the control system as a whole. As a typical example 
of such control systems, there can be mentioned a nu- 
clear reactor protecting system in a nuclear power plant 
in which control channels are provided in quadruple in 
order to ensure an extremely high reliability. In this con- 
nection, reference may be made, for example, to U.S.-A- 
4,517,154 and EP-A-1 80085 which are both concerned 
with such type of nuclear reactor protecting system as 
mentioned above. More specifically, in the nuclear reac- 
tor protecting system disclosed in these literatures, con- 
trol systems or channels are provided in quadruple, 
wherein control signals outputted from these four control 
channels are inputted to a majority decision circuit con- 
figured in the form of a 2-out-of-4 logic voting circuit so 
that a device subject to control such as, for example, a 
valve is actuated on the basis of the control signal se- 
lected by the majority decision circuit. In the case of the 
nuclear reactor protecting system disclosed in 
US-A-4517154 referred to above, a diagnosis unit is pro- 
vided for diagnosing the function of all the quadruplexed 
control channels. A single diagnosis unit produces test 
signals sequentially to the quadruplexed control chan- 
nels for making decision as to the presence or absence 
or abnormality of malfunction in each of the control chan- 
nels. 

In the nuclear reactor protecting system with the 
structure mentioned above, occurrence of abnormality 
(malfunction) in the diagnosis unit itself might lead to the 
undesirable situation in which all the quadruplexed con- 
trol channels could simultaneously output erroneous test 
signals, so that the device subject to the control might 
be inadvertently or erroneously operated. It is further not- 
ed that in this known nuclear reactor protecting system, 
the abnormality decision is not performed for the majority 
decision circuit, i.e. the signal selecting circuit itself. 

EP-A-01 09602 discloses a multiplex control system 
for controlling a device, having three control apparatuses 
for generating control signals. The control signals of 
each control apparatus are passed to a change-over 
switch. In one setting of the switch, the signals are 
passed to a signal selecting means (majority control cir- 
cuit) which selects a majority among the control signals 
and so determines a majority test signal for controlling 
the device. The switching device also receives signals 
which indicate whether the corresponding control appa- 
ratus is generating its control signal normally. If one is 
abnormal, its control signal is not passed to the signal 
selecting means but a set signal is transmitted instead. 

GB-A-1419673 discloses a control system in which 
there are two majority control circuits each connected to 



three controllers. To test the majority control circuits, 
codes are applied thereto, instead of the normal outputs 
of the three controllers and the outputs mentioned. The 
codes are applied in common to the majority control cir- 
5 cuits. 

According to a first aspect of the present invention, 
there is provided a control system for controlling a device 
as defined in claim 1 . 

According to a second aspect of the present inven- 
10 tion, there is provided a control system for controlling n 
devices, as defined in claim 2. 

Thus, the present invention may provide an im- 
proved control system in which even in the event that 
abnormality should occur in at least one of test signal 
is generating means and a mechanism for applying the test 
signal for the diagnosis of abnormality as outputted from 
the test signal generating means to the signal selecting 
means, the possibility that a device to be controlled might 
be affected by such abnormality can be reduced to a pos- 
sible minimum, while making it possible to diagnose the 
signal selecting means (majority decision circuit) with re- 
gard to the presence of abnormality. 

Because the test signals for the diagnosis of abnor- 
mality as outputted from all the signal generating means 
provided in one-to-one correspondence with the plurality 
of control apparatuses are inputted to the signal selec- 
tion means which is so designed to select the proper in- 
put signal from a number of the input signals, the device 
being controlled (e.g. a valve being monitored) can be 
protected against the influence of an abnormal test sig- 
nal. This is true even when such abnormal test signal is 
produced due to occurrence of abnormality in at least 
one of the test signal generating means and a mecha- 
nism for applying the outputted abnormality diagnosing 
test signal to the signal selecting means circuit should 
be applied to the signal selecting means. Also, since 
each of the diagnosis units provided in correspondence 
with the plurality of control apparatuses may perform the 
diagnosis of an abnormality of the signal selecting 
means with the aid of all the signals inputted to the signal 
selecting means and the output signals of individual log- 
ical elements of the signal selecting means, the abnor- 
mality diagnosis of the signal selecting means can be 
carried out early. 

Embodiments of the present invention will now be 
described in detail, by way of example, with reference to 
the accompanying drawings, in which: 

Fig 1 is a schematic diagram showing an arrange- 
ment of a triplex control system according to a first 
embodiment of the present invention; 
Fig 2 is a circuit diagram showing a structure of a 
majority decision circuit employed in the control sys- 
tem shown in Fig. 1 ; 

Fig. 3 is a circuit diagram showing a structure of 
diagnosis unit employed in the control system 
shown in Fig. 1 ; 

Fig. 4 illustrates in a flow chart a processing proce- 
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dure executed by the diagnosis unit; 
Fig. 5 is a view for illustrating signal patterns stored 
in the ROM of the diagnosis unit shown in Fig. 3 and 
indicating the normal state of the majority decision 
circuit; s 
Fig. 6 shows in a timing diagram the waveforms of 
test signals outputted from change-over switches 
shown in Fig. 1 ; 

Fig. 7 is a schematic circuit diagram showing 
another configuration of the majority decision circuit; 10 
Fig. 8 is a viewfor illustrating functional arrangement 
of the diagnosis unit shown in Fig. 3; 
Fig. 9 is a schematic diagram showing a general 
arrangement of a triplex control system according to 
another embodiment of the present invention; is 
Fig. 10 is a schematic circuit diagram showing a 
structure of a latch device employed in the system 
shown in Fig. 9; 

Fig. 11 is a schematic circuit diagram showing a 
structure of a diagnosis unit employed in the system 20 
shown in Fig. 9; 

Figs. 12 and 13 show flow charts for illustrating 
processing procedures executed by the diagnosis 
unit in t he system shown in Fig. 11 ; 
Fig. 14 is a view illustrating functional arrangement 25 
of the diagnosis unit employed in the system shown 
in Fig. 11; 

Fig. 15 is a schematic circuit diagram showing a 
structure of the latch device according to another 
embodiment; 30 
Fig. 16 is a schematic diagram showing a general 
arrangement of a triplex control system according to 
still another embodiment of the present invention; 
Fig. 1 7 is a circuit diagram showing a structure of a 
control apparatus employed in the system shown in 35 
Fig. 16; 

Fig. 18 is a circuit diagram showing a structure of 
the diagnosis unit employed in the system shown in 
Fig. 16; 

Fig. 1 9 is a flow chart illustrating a processing pro- 40 
cedure executed by the control apparatus shown in 
Fig. 17; 

Fig. 20 is a flow chart illustrating a processing pro- 
cedure executed by the diagnosis unit shown in Fig. 
18; 45 
Fig. 21 is a view showing a functional arrangement 
of the diagnosis unit shown in Fig. 18; 
Fig. 22 is a schematic diagram showing a general 
arrangement of a triplex control system according to 
a further embodiment of the present invention; so 
Fig. 23 is a schematic diagram showing a general 
arrangement of a quadruplex control system accord- 
ing to a still further embodiment of the present inven- 
tion; 

Fig. 24 is a circuit diagram showing a structure of a 55 
majority decision circuit employed in the system of 
Fig. 23; 

Fig. 25 is a circuit diagram of a diagnosis unit 



employed in the system of Fig. 23; 
Fig. 26 is a view illustrating a processing procedure 
executed by the diagnosis unit of the system shown 
in Fig. 25; 

Fig. 27 is a timing tir.iri illustrating waveforms of the 
test signals outputted Dy change-over switches 
employed in the system of Fig. 23; 
Fig. 28 is a view showing, listed in a table, those 
relays which can be monitored by the signal detec- 
tors shown in Fig. 24; 

Fig. 29 is a view showing signal patterns indicative 
of normal state of the majority decision circuits in the 
system of Fig. 23; 

Fig. 30 is a view for illustrating a functional arrange- 
ment of the diagnosis unit employed in the system 
of Fig. 23; 

Fig. 31 is a circuit diagram showing another exem- 
plary structure of the majority decision circuit which 
can be employed in the system shown in Fig. 23. 

Now, the present invention will be described in detail 
in conjunction with a preferred and exemplary of the mul- 
tiplex control system imparted with a diagnosis function 
by reference to Fig. 1. The multiplex control system 
shown in this figure is implemented in the form of a triplex 
control system, by way of example. 

The triplex control system shown in Fig. 1 includes 
three control apparatuses (controllers) 1A, 1B and 1C 
and majority decision circuits 10A, 10B and 10C, being 
disposed in parallel with one another. In the case of the 
instant embodiment, the control apparatus 1 A is associ- 
ated with the majority decision circuit 1 0A in a pair. Sim- 
ilarly, the control apparatus 1 B is paired with the majority 
decision circuit 10B, while the control apparatus 1C is 
associated with the majority decision circuit 10C. Be- 
sides, the control apparatus 1 A is provided with a diag- 
nosis unit 2A in a paired form. Similarly, the control ap- 
paratus 1B is paired with a diagnosis unit 2B, while the 
control apparatus 1C is provided with a diagnosis unit 
20. In other words, the diagnosis units are provided in a 
number corresponding to the redundancy with which the 
control system is implemented. 

The control apparatus 1 A is connected to a station- 
ary contact 4A of a change-over switch SWA which in- 
cludes the other stationary contacts 4B and 4C and a 
movable contact 4D having one end connected to the 
stationary contact AC. The other end of the movable con- 
tact 4D is adapted to be exchangeably connected to ei- 
ther the stationary contact 4A or 4B. Change-over 
switches SWB and SWC connected to the control appa- 
ratuses 1Band 1C, respectively, are implemented in the 
same structure as the change-over switch SWA. A wiring 
conductor 1 9A connected to the stationary contact 4C of 
the change-over switch SWA is connected to the majority 
decision circuit 10A. Similarly, wiring conductors 19B 
and 19C connected to the change-over switches SWB 
and SWC, respectively, lead to the majority decision cir- 
cuits 10Ato 10C, respectively. 
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Fig. 2A shows an exemplary circuit configuration of 
the majority decision circuit 10A. As will be seen in this 
figure, the majority decision circuit 10A is composed of 
logical sum elements or OR gates 5A to 5C connected 
in parallel and a logical product element or AND gate 6A s 
having inputs connected to the outputs of the OR gates 
5 A to 5C, respectively. In other words, the majority deci- 
sion circuit 1 0A is implemented in the form of a 2-out-of-3 
voting logic device. The input terminals of the OR gate 
5 A are connected to the wiring conductors 1 9 A and 1 9B, 
respectively. Similarly, the input terminals of the OR gate 
5B are connected to the wiring conductors 1 9B and 1 9C, 
respectively, while those of the OR gate 5C are connect- 
ed to the wiring conductors 19C and 19A, respectively. 
It should be mentioned that the majority decision circuit 
10B and 1 0C are implemented in the same configuration 
as the majority decision circuit 10A. As described previ- 
ously, each of the majority decision circuits 1 0A, 1 0B and 
10C realizes the 2-out-of-3 voting logic. The output ter- 
minal of the AND gate 6A which constitutes the output 
terminal of the majority decision circuit 10A is connected 
to a valve 1 3A to be controlled through a wiring conductor 
20A. In the similar manner, a valve 13 to be controlled is 
connected to the output terminal of the majority decision 
circuit 1 0B through a wiring conductor 20B, while a valve 
1 3C subject to the control is connected to the majority 
decision circuit IOC by way of a wiring conductor 20C. 

Turning to Fig. 1 , a signal detector 7A is provided in 
association with the wiring conductor 1 9A leading to the 
input of the majority decision circuit 1 0A. Further, a signal 
detector 8A is provided for the wiring conductor 19B 
while a signal detector 9 A is provided in association with 
the wiring conductor 19C. In the similar manner, signal 
detectors 7B, 8B are provided in association with the wir- 
ing conductors 19A, 19B and 19C, respectively, on the 
input side of the majority decision circuit 10B, while sig- 
nal detectors 7C, 8C and 9C are provided for the con- 
ductor 1 9 A, 19B and 1 9C, respectively, on the input side 
of the majority decision circuit 1 0C, as is shown in Fig. 
1 . It is also noted that signal detectors 1 1 A, 1 1 B and 1 1 C 
are provided in association with wiring conductors 20A, 
20B and 20C connected to the output terminals of the 
majority decision circuit 10A, 1 0B and 10C, respectively. 
Besides, signal detectors 12A, 12B and 12C are provid- 
ed on the output sides of the OR gates 5A, 5B and 5C, 
respectively, in the majority decision circuit 10A, as 
shown in Fig. 2. It should be understood that these sorts 
of the signal detectors 12A, 12B and 12C are also pro- 
vided in the majority decision circuits 10B and 10C, re- 
spectively, in the same arrangement as in the case of the 
majority decision ci rcuit 1 0A. Each of the signal detectors 
mentioned above may be constituted by a device de- 
signed to measure directly the potential at the associated 
circuit point for detecting a signal or alternatively by a 
device designed to measure the current flowing through 
the associated circuit point in a contactless manner. It is 
however preferred that a contactless current transformer 
typical of the latter should be employed as the signal de- 



tector because the current transformer type signal de- 
tector is capable of measuring the current regardless of 
whether the current to be measured is an AC or a DC 
current. Besides, because of the contactless measure- 
ment, any failure in the signal detector itself would exert 
no adverse influence to the associated control channel. 
In other words, the triplex control system need not be 
operated in a common mode even when failure occurs 
in any one of the signal detectors, to advantage. More 
preferably, the contactless signal detector can be consti- 
tuted by a CT current sensor disclosed, for example, in 
a Japanese literature entitled "Sensor Interfacing", No. 
3, pp. 111 - 116 (published Feb. 2, 1987). In particular, it 
is noted that the CT current sensor disclosed in the 
above literature incorporates no power supply source, 
which is very favorable to the triplex control system in 
which the common mode should be evaded to the limit 
of possibility. 

The signal detectors 12A, 12B and 12C serve as 
means for detecting the output signals of the logical el- 
ements (i.e. OR gates 5A, 5B and 5C) of the majority 
decision circuit 10A to thereby output detection signals 
designated collectively by 17A. On the other hand, the 
signal detector 11 A serves as a means for detecting the 
output signal of the logical element (AND gate 6A) con- 
stituting other part of the majority decision circuit 10A to 
thereby output a detection signal designated by a symbol 
1 8A in Fig. 1 . The signal detectors 7A, 8A and 9A serve 
to detect three signals (i.e. signals a, b and c) inputted 
to the majority decision circuit 10A through the wiring 
conductors 1 9A to 1 9C, respectively, to thereby output 
signals designated collectively by a symbol 1 6 A. The de- 
tection signals 16A, 17Aand IBAare supplied to the di- 
agnosis unit2A. Similarly, the detection signals 16B, 17B 
and 1 8B produced, respectively, by the signal detectors 
7B to 9B, the signal detectors 12A to 12C incorporated 
in the majority decision circuit 10B and the signal detec- 
tor 1 1 B are supplied to the diagnosis unit 2B. On the oth- 
er hand, the detection signals 16C, 17C and 18C pro- 
duced, respectively, by the signal detectors 7C to 9C, the 
signal detectors 12A to 12C incorporated in the majority 
decision circuit 1 0C and the signal detector 1 1 C are sup- 
plied to the diagnosis unit 2C. 

Referring to Fig. 3, the diagnosis unit 2A is consti- 
tuted by a microprocessor (microcomputer) and includes 
a read-only memory or ROM 24, a central processing 
unit (CPU) 25, a random access memory (RAM) 26, an 
output circuit 27 and an input circuit 28, wherein these 
components are interconnected by an address bus 29 
and a data bus 30. The detection signals 16 A, 17A and 
18A mentioned above are applied to the input circuit 28. 
The ROM 24 serves to store a processing procedure il- 
lustrated in Fig. 4 and the states of the individual detec- 
tion signals (shown in Fig. 5) which must make appear- 
ance in the normal operation. The CPU 25 executes 
arithmetic operations in accordance with the processing 
procedure illustrated in Fig. 4. The RAM 26 serves to 
store temporarily the data inputted through the input cir- 
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cuit or interface 28 as well as the results of the arithmetic 
operation performed by the CPU 25. The wiring conduc- 
tor 3A, 21 A and 22B are connected to the output circuit 
or interface 27. More specifically, the wiring conductor 
3A is connected to a display unit 23 for transmitting in- 5 
formation concerning the results of the abnormality de- 
cision made by the diagnosis unit 1 0A to a display unit 
23. The wiring conductor 21 A is connected to the sta- 
tionary contact 4B of the change-over switch SWA and 
carries a test signal S. The wiring conductor 22B is con- 
nected to the change-over switch SWA and carries a test 
command signal CH. 

The other diagnosis unit 2B and 2C are realized in 
the same structure as the diagnosis unit 2A and serve 
for the same functions as those of the diagnosis unit 2A, 
which will be described in more detail later on. The wiring 
conductors 3B, 2 1 B and 22B are connected to the output 
interface 27 of the diagnosis unit 2B. The other end of 
the wiring conductor 3B is connected to the display unit 
23, while that of the wiring conductor 21 B is connected 
to the stationary contact 4B of the change-over switch 
SWB. Further, the wiring conductor 22B is also connect- 
ed to the change-over switch SWB as shown in Fig. 1 . 
The wiring conductor 3C connected to the display unit 
23, the wiring conductor 21 C connected to the stationary 
contact 4B of the change-over switch SWC and the wir- 
ing conductor 22C also connected to the change-over 
switch SWC have respective other ends connected to 
the output circuit 28 of the diagnosis unit 2C. The signals 
carried by the wiring conductors 3B and 3C, respectively, 
are same as the signal transmitted through the wiring 
conductor 3A. Further, the signals transmitted through 
the wiring conductors 21 B and 21 C, respectively, are 
same as the signal transmitted through the wiring con- 
ductor 21 A, while the signals on the wiring conductors 
22B and 22C are same as the signal carried by the wiring 
conductor 22A. 

Next, description will be directed to the operation of 
the triplex control system according to the instant em- 
bodiment of the present invention. The functions or op- 
erations of the control apparatuses or controllers, the di- 
agnosis units, the change-over switches and the majority 
decision circuits 10 each provided in triplex are identical 
among the three control channels. Accordingly, the fol- 
lowing description concerning operation of the control 
system will be made by reference to the channel includ- 
ing the control apparatus 1 A, the diagnosis unit 2A and 
the majority decision circuit 1 0, being understood that the 
same applies true to the corresponding components of 
the other channels. 

The control apparatus or controller 1 A is supplied as 
the input signal thereto with measurement signals pro- 
duced by sensors (not shown) installed in the plant to 
thereby output a signal a for controlling the opening de- 
grees of the valves 1 3A, 1 3B and 1 3C, respectively. The 
change-over switch SWA is maintained in the state in 
which the movable contact 4D is connected to the sta- 
tionary contact 4A so long as the test command signal 



CH outputted from the diagnosis unit 2A is absent. Con- 
sequently, the signal a outputted from the control appa- 
ratus 1 A is supplied to the input of the majority decision 
circuit 10A by way of the change-over switch SWA and 
the wiring conductor 1 9A. At the same time, a signal b 
outputted from the control apparatus 1 B is supplied to 
the input of the majority decision circuit 10A. Besides, a 
signal c produced by the control apparatus 1C is also 
supplied to the majority decision unit 10A. It should be 
noted that the signals a, b and c are also supplied to the 
majority decision circuit 10B and 10C simultaneously. 
The signals a, b and c are digital signals each including 
logic "0" and logic m 1 9 levels. 

The majority decision circuit 10A constitutes a sort 
of signal selecting means arranged so as to decide 
whether the three input signals coincide with one another 
to thereby output as a correct control signal which cor- 
responds to at least two inputs which coincide with each 
other. (Same holds true for the majority decision circuits 
1 0B and 1 0C.) More specifically, when at least two of the 
three input signals a, b and c are logic "1", the majority 
decision circuit 10A selects the logic "1" signal as the 
control signal for the valve 1 3A. On the other hand, when 
at least two of the three input signals a, b and c are logic 
"0", the majority decision circuit 10A selects the signal of 
logic "0" as the control signal to be supplied to the valve 
1 3A. When the signal outputted from the majority deci- 
sion circuit 10A is logic "1", the valve 13A is opened, 
while it is closed when the output signal from the majority 
decision circuit 10A is logic "0". 

The operation described above represents a normal 
control operation of the triplex control system according 
to the instant embodiment of the invention. The following 
description will be turned to the diagnosis function for the 
majority decision circuits (10) of the triplex control sys- 
tem for deciding the presence or absence of abnormality 
in these majority decision circuits. The diagnosis for de- 
termining the presence or absence of abnormality is per- 
formed by the diagnosis units 2A, 2B and 2C, respec- 
tively. Fig. 4 shows a processing procedure which can 
be executed by the diagnosis unit 2A to this end. Of 
course, the processing procedure shown in Fig. 4 also 
applies valid to the diagnosis unit 2B by reading "signals 
16A to 18 A" occurring in Fig. 4 as "signal 16B to 18B", 
respectively. Similarly, the processing procedure per- 
formed by the diagnosis unit 2C corresponds to the pro- 
cedure shown in Fig. 4 by replacing "signals 16Ato 18A" 
by "signal 16C to 18C, respectively. 

In the diagnosis unit 2A, the processing based on 
the procedure illustrated in Fig. 4 and stored in the ROM 
21 is executed by the CPU 25. At first, the CPU 25 out- 
puts the test signal S of logic "0" on the wiring conductor 
21 A for diagnosing the triplex control system (more spe- 
cifically, the majority decision unit and the diagnosis unit) 
as to the presence of abnormality, while outputting the 
test command signal CH onto the wiring conductor 22A 
(step 31 in Fig. 4). The outputting of the test signal S of 
logic "0 B is equivalent to the state in which a pulse-like 



15 



20 



25 



30 



35 



40 



45 



50 



5 



9 



EP 0 307 191 B1 



10 



test signal S for the diagnosis of abnormality as de- 
scribed hereinafter is not outputted. The test signal S of 
the logic "0" is applied to the stationary contact 4B of the 
change-over switch SWA. In this state, the movable con- 
tact 4D of the change-over switch SWA is connected to 
the stationary contact 4B in response to the test com- 
mand signal CH. Upon interruption in the outputting of 
the test command signal CH, the movable contact 4D of 
the change-over switch SWA is connected to the station- 
ary contact 4A. The time interval or period during which 
the movable contact 4D remains in the state connected 
to the stationary contact 4B is equal to a pulse width or 
duration T Q of the pulse-like test signal S described here- 
inafter. By virtue of this feature, the valve 1 3A opened in 
response to the control signals (of logic "1") issued by 
the control apparatuses 1 A and 1 B is prevented from be- 
ing closed even when the test signals of logic "0 B con- 
tained in the signals a, b and c should overlap each other. 
The change-over switch SWA responds to the input of 
the test command signal CH by outputting the test signal 
S of logic "0° as the signal a in place of the output signal 
from the control apparatus 1 A. This signal a is supplied 
to the majority decision circuits 10B and 10C as well. At 
a step 32, the diagnosis unit 2A fetches the following data 
signals. In other words, the detection signals 16A pro- 
duced by the signal detectors 7A, 8A and 9A, the detec- 
tion signals 1 7A outputted from the signal detectors 1 2A, 
1 2B and 1 2C incorporated in the majority decision circuit 
10A and the signal 18A outputted from the signal detec- 
tor 11 A are once loaded in the RAM 26 by way of the 
input circuit 28 and the data bus 30. The CPU 25 com- 
pares the input signals 16A to 18A with the output pat- 
terns (patterns labelled No. 1 to 8 shown in Fig. 5) of 
these signals in the normal state of the majority decision 
circuit 10A (step 33). Subsequently, decision is made as 
to the presence or absence of abnormality in the majority 
decision circuit 10A (step 34). In this conjunction, it is 
assumed, by way of example, that the detection signals 
of the signal detectors 7A to 9A (the input signals to the 
majority decision circuit 10A) are all of logic "0" as in the 
case of the pattern No. 1 shown in Fig. 5. It is then de- 
cided that the majority decision circuit 1 0A functions nor- 
mally without suffering from any abnormality when the 
detection signals of the signal detectors 1 2A to 1 2C and 
1 8A (output signal of the individual logical elements con- 
stituting the majority decision circuit 10A) are all of logic 
"0°. On the other hand, when the detection signal of the 
signal detector 12B is logic "1", this means that discrep- 
ancy with the pattern No. 1 shown in Fig. 5 is present. In 
that case, it is decided at a step 34 that the OR gate 5B 
of the majority decision circuit 10A suffers from abnor- 
mality. Next assuming, by way of another example, that 
the output signal 18A of the signal detector 11 A is logic 
"1 ", there exists discrepancy with the pattern labelled No. 
1 (Fig. 5). Thus, decision can be made to the effect that 
abnoramlity is present in the AND gate 6 A of the majority 
decision circuit 10A. When it is decided at the step 34 
that abnormality is present, the component of the major- 



ity decision circuit 10A which suffers from abnormality is 
informed to the display unit 23 by way of the output circuit 
27 and the wiring conductor 3A (step 36). The display 
unit 23 responds thereto by display the abnormal com- 
5 ponent of the majority decision circuit 1 0A. An alarm may 
also be produced at the step 36. 

When the decision made at the step 34 results in the 
absence of abnormality, the processing procedure pro- 
ceeds to a step 35. In this step 35, the pulse-like test 
signal S including a row of logic "0", "1 B and "0" levels in 
this sequence is issued from the output circuit 27 of the 
diagnosis unit 2 A to be applied by way of the wiring con- 
ductor 21 A to the changeover switch SWA together with 
the test command signal CH, whereupon the 
changeover switch SWA transmits the pulse-like test 
signal S as the signal a to each of the majority decision 
circuits. At a step 32A, the detection signals 16A to 18A 
detected by the respective signal detectors are inputted 
simultaneosuly (i.e. the signals detected at a same time 
point are inputted) to the diagnosis unit 2A be stored in 
the RAM 26 as in the case of the step 32 described pre- 
viously. At the same time, the number of times the de- 
tection signals 16A to 18A are inputted in succession to 
the output of the pulse-like test signal S are counted at 
the step 32A, wherein the counted number is stored in 
the RAM 26. At a succeeding step 37, each of the signals 
16A outputted from the signal detectors 7A to 9A, re- 
spectively, is checked as to whether the signal 16A has 
undergone any change when compared with the state of 
the same signal inputted at the last (preceding) time 
point. The signal 16A undergone the change is stored in 
the RAM 26. It is however to be noted that the signal 16A 
undergone no change may alternatively be stored in the 
RAM 26. In steps 33A and 34A, the processings similar 
to those described above in conjunction with the steps 
34 and 35 are performed. The processing at the step 37 
may be executed in succession to the step 34A. 

At a step 38, the number of times the detection sig- 
nals 16A to 18A are inputted to be stored in the RAM 26 
is compared with a preset number of times, whereby de- 
cision is made as to whether the number of times the 
signals are inputted has attained the predetermined 
number. Unless the number of times the detection sig- 
nals were inputted has reached the predetermined 
number, the processing steps 32A, 37, 33A, 34A and 38 
are repeatedly executed. When it is decided at the step 
38 that the number of times the signals were inputted 
has attained the predetermined number, then a step 39 
is performed. At this step 39, it is decided whether there 
exists among the three signals 16A detected and stored 
in the RAM 26 at the steps 37 any signal that has under- 
gone no change. This decision in its essence is equiva- 
lent to the decision made as to the presence or absence 
of the abnormal diagnosis unit which produces constant- 
ly the test signal S undergone no change among the di- 
agnosis unit 2A, 2B and 2C which output the respective 
pulse-like test signals S, the reason for which will be ex- 
plained in detail later on. In case the change had oc- 
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curred in ail of the three signals 16A until the number of 
the times the signals are inputted has attained the pre- 
determined number or count, this means that all of the 
diagnosis units 2A, 2B and 2C function normally. In this 
case, the processing at the step 31 is resumed, where- 
upon the succeeding steps are executed sequentially. 
On the other hand, when it is decided at the step 39 that 
there exists the signal 16A undergone no change, ab- 
normality of the diagnosis unit outputting the test signal 
S onto the wiring conductor (at least one of the wiring 
conductors 1 9A, 1 9B and 1 9C) which is associated with 
the signal detector (at least one of the signal detectors 
7A, 8A and 9A) detecting the signal 1 6A undergone no 
change is displayed on the display unit 23 (step 40). 

The processing procedure illustrated in Fig. 4 is ex- 
ecuted by the diagnosis units 2B and 2C as well. In re- 
sponse to application of the pulse-like test signals from 
the diagnosis units 2A, 2B and 2C, the signals a, b and 
c each containing the pulse-like test signal, as is illus- 
trated in Fig. 6, are outputted from the change-over 
switches SWA, SWBand SWC, respectively. In conjunc- 
tion with Fig. 6, it will be noted that the control signals of 
logic "1" outputted from the control apparatuses 1 A, 1B 
and 1C when the associated movable contacts 4D are 
connected to the stationary contacts 4A of the associat- 
ed change-over switches SWA, SWB and SWC are omit- 
ted from illustration. The diagnosis units 2A, 2B and 2C 
operate asynchronously with one another to output the 
test signals S and the test command signals CH. Con- 
sequently, the signals a, b and c outputted from the as- 
sociated change-over switches include the pulse-like 
test signals of different periods (i.e. the pulse-like test 
signals having different periods T A , T 2 and T 3 ) which are 
outputted from the diagnosis units 2A, 2B and 2C, re- 
spectively. Each of the pulse-like test signals S is a pulse 
signal having such a duration T 0 (not longer than 1 00 ms 
in the case of the instant embodiment) during which the 
devices to be controlled (i.e. the valves 13Ato 13C in the 
case of the instant embodiment) can remain inoperative 
even when the signals a, b and c overlap one another, 
as indicated at a time point t 3 . The individual signals 
shown in Fig. 6 represent the state in which the pulse-like 
test signals outputted from the associated diagnosis 
units are applied through corresponding manipulation of 
the change-over switches, wherein the control signal of 
logic "1 " transmitted from the control apparatus when the 
movable contact 4D of the associated change-over 
switch is connected to the stationary contact 4A to which 
the abovementioned control apparatus is connected (i.e. 
the state intervening two successive pulse-like test sig- 
nals) is omitted from illustration. Additionally, the individ- 
ual signals shown in Fig. 6 indicate the state in which the 
control signal of logic "1 " is not outputted from the control 
apparatus between the two successive pulse-like test 
signals S (i.e. the state in which only the control signal 
of logic "0° is outputted). It should further be mentioned 
that the test signal of logic "0" outputted at the step 31 is 
produced in precedence to the pulse-like test signal 



shown in Fig. 6. 

As will be seen in Fig. 6, the pulse-like test signal c 
is of the shortest period T 3 among the signals a, b and 
c. The time interval (period T 3 ) between two successive 
s pulse-like test signals S in the signal c is so selected that 
a series of steps intervening between the step 35 being 
currently executed and the same step 35 to be executed 
at the next cycle in the procedure shown in Fig. 4 can be 
executed within this period T 3 . The test signal S and the 
10 test command signal CH shown in the step blocks 31 
and 35 in Fig. 4 are generated by an oscillator (omitted 
from illustration of the diagnosis unit shown in Fig. 3 but 
shown in Fig. 8 as referred to later on) and outputted from 
the diagnosis unit at the time interval corresponding to a 
15 predetermined number of pulses as detected by a coun- 
ter (not shown in Fig. 3 but described hereinafter in con- 
junction with another embodiment shown in Fig. 8). In- 
putting of the signals 1 6 A to 1 8A at the steps 32 and 32A 
is also performed at a time interval corresponding to a 
20 predetermined number of pulses detected by another 
counter (also not shown in Fig. 3). The outputs of the 
counters mentioned above are supplied to the CPU 25 
by way of the data bus 30. 

Next, operation of the diagnosis unit for deciding the 
25 presence or absence of abnormality in the very diagnosis 
unit will be described. The signal a containing the 
pulse-like test signal S outputted from the diagnosis unit 
2A periodically at the time interval T t is detected by the 
signal detectors 7B and 7C to be subsequently inputted 
30 to the diagnosis units 2B and 2C, respectively. Thus, the 
diagnosis unit 2B as well as 2C can decide the presence 
or absence of abnormality in the diagnosis unit 2A by 
detecting whether the input signal a has changed its 
state from logic "0° to logic "1" or vice versa until the 
35 number of times the signals 16A to 18A were inputted 
has attained the predetermined number or count, as de- 
termined at the step 32A. As the abnormality of the di- 
agnosis unit, there may be mentioned abnormality or 
malfunction of the ROM 24, the CPU 25, the output circuit 
*o 27 and the data bus 30. It goes without saying that such 
abnormality of the diagnosis unit 2A can also be deter- 
mined by the diagnosis unit 2A itself. The decision made 
at the step 38 that the number of times the signal were 
inputted has attained a predetermined value in turn 
45 means that a predetermined time has lapsed after the 
pulse-like test signal S was outputted. In case no test 
signal is outputted from the diagnosis unit 2A, the signal 
detector 7 A detects the output signal of the control ap- 
paratus 1 A to thereby input that signal to the diagnosis 
50 unit 2A, which is however incapable of deciding whether 
the signal incoming from the signal detector 7A is the test 
signal or the control signal. In this conjunction, it is noted 
in general that the control apparatus 1 A continues to out- 
put the signal of logic "0" or alternatively logic "1 " in the 
55 steady state except for the transient state. Accordingly, 
abnormality of the diagnosis unit can be decided when 
the control signal outputted from the control apparatus 
1 A is in the steady state. The foregoing holds true for the 
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control apparatuses 1 B and 1C and the diagnosis units 
2B and 2C. 

Each of the diagnosis units according to the instant 
embodiment can detect the presence or absence of ab- 
normality as well as the malfunctioning component in the 
majority decision circuits 10A to 10C on the basis of the 
patterns illustrated in Fig. 5 with the aid of the input sig- 
nals 1 6A to 1 8A not only in the state where only the test 
signal S is outputted but also in the state where only the 
control signals are outputted from the control apparatus 
1 A to 1 C as well as in the state where the control signals 
are issued as mixed with the test signal. 

The diagnosis units 2Ato 2C according to the instant 
embodiment of the invention are arranged to output the 
test signal in place of the corresponding control appara- 
tuses 1 A to 1C. With the aid of the test signal as output- 
ted, the diagnosis units 2A, 2B and 2C can be inputted 
with the detection signals 16A to 18A constituting all the 
patterns Nos. 1 to 8 illustrated in Fig. 5, whereby decision 
can be made as to the presence or absence of abnor- 
mality in the majority decision circuits 10A to 10C for all 
the modes of the input signals thereto and hence the 
presence or absence of the abnormality in the individual 
logical elements constituting the majority decision cir- 
cuits 10A to 10C. According to the instant embodiment 
of the invention, the decision as to the presence or ab- 
sence of abnormality can be made by utilizing the output 
signals of the control apparatuses 1A to 1C as well. In 
that case, however, the abnormality decision can not be 
executed for all the patterns mentioned above because 
the forms of the output signals of the control apparatuses 
1 A to 1C are limited inherently 

Further, according to the instant embodiment of the 
invention, the triplex control system can be simplified 
with regard to the structure because of no necessity for 
providing any change-over switch between each major- 
ity decision circuit and each device to be controlled (i.e. 
the valve in this case) for the purpose of transmitting the 
output of the majority decision circuit to the relevant di- 
agnosis unit rather than the valve upon occurrence of 
abnormality. 

Besides, by virtue of such arrangement that the 
three diagnosis units are provided, respectively, in asso- 
ciation with the control apparatuses independent of one 
another, the probability of the device subject to one an- 
other, the probability of the device to be controlled (e.g. 
valve) being influenced can be significantly lowered, 
even when the abnormal test signal is inputted to the ma- 
jority decision unit upon occurrence of abnormality in one 
of the diagnosis units (failure or malfunction in at least 
one of the CPU 25, the bus 30, the output circuit 27 and 
the aforementioned counters although not shown in the 
case of the system under consideration or failure in at 
least one of a test signal generating means J1, a test 
command signal generating means J2, a counter J3 and 
output circuits J9, J10 and others described hereinafter 
in conjunction with Fig. 8). This advantageous feature is 
ascribable to such arrangement of the control system ac- 



cording to the instant embodiment that the diagnosis 
units are prevented from operating in a common mode 
to all the control apparatuses 1 A to 1 C, whereby one of 
the majority decision circuits is always supplied with two 

5 normal signals (i.e. the test signal outputted from the test 
signal generating means of the diagnosis unit and two of 
the control signals outputted from the two control appa- 
ratuses connected to the two corresponding 
change-over switches to which the output signals of the 

10 two diagnosis units suffering no abnormality are con- 
nected in the case of the instant embodiment). The bus 
30, the output circuit 27 and the counters cooperate with 
each other to constitute a means or mechanism for ap- 
plying the test signal for the abnormality diagnosis to the 

is majority decision circuit which serves as the signal se- 
lecting circuit. 

According to the instant embodiment of the inven- 
tion, the time width or duration T 0 of the pulse-like test 
signal S is so selected that the device to be controlled 

20 can not be activated. Thus, any failure in one of the di- 
agnosis units could never lead to operation of the device 
under the control. 

Further, in the instant embodiment, the periods or 
time intervals at which the pulse-like test signals are out- 

25 putted from the diagnosis units 2A, 2B and 2C, respec- 
tively, are previously so established as to differ from one 
another. Accordingly, various combinations of the 
pulse-like test signals S such as illustrated in Fig. 6 can 
be obtained, whereby the diagnosis with the various pat- 

30 terns shown in Fig. 5 can be correspondingly facilitated. 
The abnormality decision for the majority decision 
circuits and the diagnosis units as described hereinbe- 
fore can be carried out regardless of whether the triplex 
control system is in the state capable of performing the 

35 control operation or in the state receiving maintenance 
and/or inspection. 

Since the individual diagnosis units as well as the 
control apparatuses operate in asynchronism with one 
another, occurrence of the common mode due to syn- 

40 chronization can be prevented positively, whereby the 
reliability is enhanced. 

Further, according to the instant embodiment of the 
invention, establishment of the various types of common 
modes can be avoided, which means that the reliability 

45 of the triplex control system can be significantly en- 
hanced. 

In the foregoing description of the instant embodi- 
ment, it has been assumed that the valves 1 3A, 1 3B and 
1 3C are opened in response to the signal of logic "1 " 

50 while they are closed with the signal of logic °0°. It should 
however be understood that the valves can be set to the 
open state in response to the signal of logic "0 D while 
being closed with the signal of logic °1 n . 

The majority decision circuit shown in Fig. 2 may be 

55 replaced by a majority decision circuit 1 0A 1 shown in Fig. 
7. Same holds true for the other majority decision circuits 
10B and 10C. Referring to Fig. 7, the majority decision 
circuit 10A, is constituted by three AND gates 6B, 6C 
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and 6D and an OR gate 5 D which is so arranged as to 
receive at the inputs thereof the outputs of the AND gates 
6B, 6C and 6D. The signal detectors 12A, 12B and 12C 
detect the outputs of the AND gates 6B, 6C and 6D, re- 
spectively. The output terminal of the OR gate 5D is con- 
nected to the wiring conductor 20A. On the other hand, 
the wiring conductors 19 A, 19B and 19C are connected 
to the input terminals of the AND gates 6B to 6C in such 
manner as shown in Fig. 7. 

When the outputs of three OR gates of the majority 
decision circuit 1 0A (Fig. 2) are so wired as to realize the 
function of AND gate (i.e. the AND gate based on the 
wired logic) for thereby replacing the AND gate 6A, the 
abnormality diagnosis is rendered unnecessary to the 
AND gate realized in the form of the wired logic. Conse- 
quently, the signal detector 1 1 A can be spared. 

Fig. 8 illustrates in a functional diagram the functions 
of the diagnosis unit 2A of the control system shown in 
Fig. 1 . The following description made with reference to 
Fig. 8 applies valid to the diagnosis units 2b and 2C as 
well. In a diagnosis unit 2A' representing functionally the 
diagnosis unit 2A, the pulses outputted from a pulse gen- 
erating means J4 are counted by a counter means J3. 
When the number of the counted pulses has attained a 
first predetermined value, the counter means J3 produc- 
es a signal to both of test signal generating means J1 
and test command signal output means J2. The test sig- 
nal generating means J1 and the test command signal 
output means J2 respond to the input of the abovemen- 
tioned signal by outputting the test signal S and the test 
command signal CH to the wiring conductors 21 A and 
22A through the output means J9 and J10, respectively. 
The input means J8 is supplied with the detection signals 
1 6A to 1 8A in response to the signal produced when the 
number of pulses counted by the counting means J3 has 
attained a second predetermined count value. The de- 
tection signal 16A, 17Aand 18Athus inputted are once 
stored in the memory means J7. The data carried by the 
detection signals 16A to 18A and stored in the memory 
means J7 are compared with the patterns illustrated in 
Fig. 5 by the abnormality decision means J5 for the ma- 
jority decision circuit, whereby decision is made as to 
presence or absence of abnormality in the majority de- 
cision circuit 10. Further, the abnormality decision means 
J6 for the diagnosis unit detects whether there exists the 
signal 16A undergone no change among the three sig- 
nals 16A inputted within a predetermined period. When 
the signal 16A remaining unchanged over the predeter- 
mined period is present, then the decision is made that 
the diagnosis unit of concern suffers abnormality, as de- 
scribed hereinbefore. The results of the abnormality de- 
cisions made by the abnormality decision means J5 and 
J6, respectively, are outputted to the display unit 23 
through the output means J11. The diagnosis units 2B 
as well as 2C operate similarly to the operation of the 
diagnosis unit 2A' described above. 

In the processing procedure shown in Fig. 4 and ex- 
ecuted by the CPU 25 of the diagnosis unit 2A, the func- 



tion "output of the test signal" in the steps 31 and 35 cor- 
responds to that of the test signal generating means J1 , 
the function "output of the test command signal" in the 
steps 31 and 35 corresponds to that of the test command 
5 signal generating neans, the functions in the steps 33, 
34, 36, 33A and 34A correspond to those of the abnor- 
mality decision means J5, and the function "count of the 
input pulse number* in the steps 37, 38, 39, 40 and 32A 
correspond to the function of the abnormality decision 
means J6. To say in another way, the CPU 25 is imparted 
with the functions of the various means mentioned 
above. It will further be seen that the RAM 26 of the di- 
agnosis unit 2A corresponds to the memory means J7, 
the input circuit 28 corresponds to the input means J8, 
and the output circuit 27 corresponds to the output 
means J9 to J1 1 , respectively. A memory not shown but 
corresponding to the ROM is also provided (for the pur- 
pose of storing, for example, the patterns illustrated in 
Fig. 5). Since the diagnosis unit 2A' incorporates therein 
both the functions of the test signal generating means 
and the test command signal generating means, syn- 
chronization between these means can be easily real- 
ized. 

It should be added that the abovementioned various 
means of the diagnosis unit 2A' may be implemented in 
hardware structures. Needless to say, employment of 
the diagnosis unit 2 A' of hardware structure in place of 
the diagnosis units 2A, 2B and 2C shown in Fig. 1, re- 
spectively, can assure substantially same advantageous 
effects as those attainable with the embodiment of the 
control system shown in Fig. 1 . 

Fig. 9 shows another exemplary embodiment of the 
triplex control system according to the present invention. 
This embodiment differs from the one shown in Fig. 1 
mainly in respect that latch devices 41 A, 41 B and 41 C 
are provided. The following description will therefore be 
directed to these differences. 

The latch devices 41 A, 41 B and 41 C are implement- 
ed in the identical structure with one another. According- 
ly, the structure of the latch device 41 A will be described 
in detail by referring to Fig. 10, being understood that the 
description applies valid to the other latch devices 41 B 
and 41 C. The latch device 41 is composed of latch cir- 
cuits 42A to 42H and an AND gate 43. Each of the latch 
circuits 42A to 42H may be realized in the form of a 
flip-flop. The latch circuit 42A is connected to the signal 
detector 7 A. The latch circuit 42B is connected to the sig- 
nal detector 8 A. The latch 42C is connected to the signal 
detector 9A. The latch 42D is connected to the signal 
detector 12A. The latch 42E is connected to the signal 
detector 12B. The latch 42F is connected to the signal 
detector 12C. Finally, the latch circuit 42H is connected 
to the signal detector 1 1 A. Additionally, the signal detec- 
tors 1 2A to 1 2C are also connected to the input terminals 
of the AND gate 43 which has an output terminal con- 
nected to the latch circuit 43G. The latch circuits 42A to 
42C of the latch device 41 B are connected to the signal 
detectors 7B, 8B and 9B, respectively, while the latch cir- 
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cuit 42H is connected to the signal detector 11 B. On the 
other hand, the latch circuits 42A to 42C of the latch de- 
vice 41 C are connected to the signal detectors 7C, 8C 
and 9C, respectively, while the latch circuit 42H thereof 
is connected to the signal detector 1 1 C. The iatch circuits 
42E to 42G of the latch devices 42E and 41 C, respec- 
tively, are connected to the signal detectors 12A to 12C 
in the manner similar to the latch device 41 A. 

The diagnosis units 2A,, 2B t and 2C-, each consti- 
tuted by a microprocessor in the instant embodiment are 
substantially identical with the diagnosis units 2A, 2Band 
2C of the preceding embodiment. Considering the diag- 
nosis unit 2A t shown in Fig. 11, this unit 2A^ differs from 
the diagnosis unit 2A in that a bus 30A is provided and 
that output means 27 A to which wiring conductors 3 A, 
21 A, 22A, 44A and 45A are connected is provided. The 
wiring conductors 44A and 45 A provided additionally are 
connected to each of the latch circuits 42A to 42H of the 
latch device 41 A. Similarly, the wiring conductors 44B 
and 45B connected to the output circuit 27 A of the diag- 
nosis unit 2B-, are connected to the latch circuits 42A to 
42H of the latch device 41 B. Further, the wiring conduc- 
tors 44C and 45C connected to the output circuit 27 A of 
the diagnosis unit 2C 1 are connected to the latch circuits 
42A to 42H of the latch device 41 C. The output terminals 
of the latch circuits 42 A to 42 H of the latch devices 41 A, 
41 B and 41 C are connected to the input circuits 28 of the 
diagnosis unit 2A V 2B, and 2C 1t respectively. 

The functions of the latch devices 41 A, 41 B and 41 C 
will be described by taking as an example the latch de- 
vice 41 A. The latch circuit 42A of the latch device 41 A is 
supplied with the detection signal 16A from the signal 
detector 7A connected thereto. When the input detection 
signal undergoes a change, an edge or transition of the 
change (e.g. from logic °0 B to logic "1") is made use of 
for holding the state of the detection signal after the tran- 
sition. The latch circuit 42 A stores the state of the detec- 
tion signal fetched in response to the input of a load sig- 
nal L 0 described hereinafter. Further, the latch circuit 42A 
resets the signal stored therein to G 0" in response to the 
input of a reset signal R, supplied from the diagnosis unit 
2A, through the wiring conductor 44A. Such functions of 
the latch circuit 42A are equally imparted to each of the 
latch circuits 42B to 42H. The latch circuits 42B and 42C 
are supplied as the inputs thereto with the detection sig- 
nals 16A generated by the signal detectors 8A and 9A, 
respectively. The latch circuits 42D to 42F and the AND 
gate 43 are supplied with the detection signals 17A from 
the corresponding signal detectors 12Ato 12C, respec- 
tively. Finally, the latch circuit 42H is supplied with the 
detection signal 18A generated by the signal detector 
11 A. The output signal of the AND gate 43 is inputted to 
the latch circuit 42G. The detection signals 16A stored 
in the latch circuits 42 A to 42C, the detection signals 1 7A 
stored in the latch circuits 42D to 42G, the signal output- 
ted from the AND gate 43 and stored in the latch circuit 
42 and the detection signal 1 8A stored in the latch circuit 
42H are supplied to the input circuit 28 of the diagnosis 



unit 2A A . 

The ordinary control operation of the control system 
according to the instant embodiment is identical with that 
of the control system shown in Fig. 1 . Due to the opera- 

5 tions or actions of the diagnosis units 2A A to 2C n , the 
signals a, b and c containing the pulse-like test signals 
S as illustrated in Fig. 6 are outputted from the 
change-over switches SWA, SWBandSWC, respective- 
ly, as in the case of the embodiment shown in Fig. 1 . The 

10 diagnosis units 2A, , 2B^ and 2C, operate in asynchro- 
nism with one another. 

The processing for diagnosis as executed by each 
diagnosis unit will be described by taking as example the 
operation of the diagnosis unit 2A V being understood 

is that the diagnosis units 2B, and 2C^ execute the 
processing in the same manner as the diagnosis unit 
2A A . The CPU 25 constituting a main part of the diagno- 
sis unit 2A 1 executes the processing in accordance with 
the processing procedures illustrated in Figs. 12 and 13 

20 and stored in the ROM 24. In this connection, it should 
be mentioned that by reading the signals 16A to 18A 
shown in Fig. 12 and 13 as the signals 16B to 18B, the 
processing procedure shown in these figures also be- 
comes pertinent to the diagnosis unit 2B^ . Similarly, by 

25 reading the signals 1 6A to 1 8A as the signals 1 6C to 1 8C, 
the processing procedure shown in Figs. 1 2 and 1 3 is 
pertinent to the diagnosis unit 2^ . 

The CPU 25 executes a step 31 at first, as the result 
of which the test signal S of logic "0° is issued onto the 

30 wiring conductor 19A through the change-over switch 
SWA. This test signal S of logic "0" is transmitted to the 
majority decision circuits 1 0A to 1 0C by way of the wiring 
conductor 1 9 A. The signals b and c (each containing the 
test signal or the control signal outputted from the asso- 

35 ciated control apparatus) are outputted through the 
change-over switches SWB and SWC to be supplied to 
the majority decision units 10A, 10B and 10C, respec- 
tively. 

The detection signals 1 6A, 1 7A and 1 8A are inputted 
40 to the associated latch circuits 42A to 42F and 42H and 
the AND gate 43 incorporated in the latch device 41 A. 
When a change or transition takes place in the signals 
inputted to the latch circuits 42A, 42D, 42F, 42G and 42H 
in response to the appearance of the test signal S of logic 
45 "0" on the wiring conductor 1 9A, the associated latch cir- 
cuits mentioned above store therein the updated (new) 
state of the signals undergone the change or transition. 
The updated signals stored in the respective latch cir- 
cuits are then supplied to the input circuit 28 of the diag- 
50 nosis unit 2A 1 . On the other hand, the other latch circuits 
42B, 42C and 42E supply to the input circuit 28 the stored 
signals as they are, so long as the signal transmitted 
through the wiring conductors 1 9B or 1 9C undergoes no 
change. 

55 At the step 32, the signals 16A, 17A and 18A are 
inputted to the CPU 25 to be stored in the RAM 26 
through the data bus 30. Subsequently, the CPU 25 con- 
firms (detects) that the signals 16A to 18A have been 
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inputted and then outputs the reset signal R, (step 46). 
The reset signal R, is transmitted to the latch circuits 42A 
to 42H of the latch device 41 A through the wiring con- 
ductor 44A to clear the signals stored in the latch circuits 
42A to 42H to be logically n 0". 

Similarly to the case of the embodiment shown in 
Fig. 1, the input signals 16A to 18A are compared with 
the output patterns (Fig. 5) outputted by the majority de- 
cision circuit 10A in the normal state thereof at the step 
33, being followed by a step 34 where the presence or 
absence of abnormality in the individual components 
constituting the majority decision circuit 10A is decided. 
In case the decision at the step 34 results in the presence 
of abnormality, information of the abnormality (e.g. com- 
ponent suffering from failure) are supplied to the display 
unit 23 (step 36). 

The diagnosis unit receives at the input thereof 
the outputs from the latch circuits 42 D, 42 E and 42F and 
the output of the latch circuit 42G as the signal 17. The 
reason why the latch circuit 42G for storing the output of 
the AND gate 43 is provided can be explained as follows. 
The majority decision circuit 1 0A realized logically in the 
2-out-of-3 voting configuration can output the signal of 
logic "1 " only when the outputs of all the OR gates 5A to 
5C assume the level of logic "1 Accordingly, the major- 
ity decision circuit 1 0A can never output the signal of log- 
ic "1" at the time points t,, t 2 and t 4 shown in Fig. 6. It 
should however be noted that all of the latch circuits 42D 
to 42F store therein the signals of logic "1" at the time 
point t 4 . This can be explained by the fact that the 
change-over switches SWA, SWB and SWC output the 
respective test signals S which are deviated temporally 
from one another due to the processing executed by the 
individual diagnosis units within an extremely short peri- 
od T 4 at the step 31 . as is illustrated in Fig. 6. The latch 
circuits 42d to 42f output the signal of logic "1 " at least 
at the time point t 4 . On the other hand, the latch circuit 
42H stores the signal of logic "0" at the time point t 4 . This 
is because the AND gate 6A of the majority decision cir- 
cuit 10A issues the signal of logic "0" during the period 
T 4 . As a consequence, the diagnosis unit 2A 1 which re- 
ceives as the inputs thereto only the outputs of the latch 
circuits 42A to 42F and 42H at the time point t 4 will erro- 
neously decide that the AND gate 6A operating normally 
suffers from abnormality. In order to exclude such erro- 
neous decision, the AND gate 43 and the latch circuit 
42G are provided in the latch device 41. The AND gate 
43 outputs the logic "1 " only when the outputs of the OR 
gates 5A, 5B and 5C are simultaneously logic "1 °. Con- 
sequently, the latch circuit 42G outputs the signal of logic 
"1" to the diagnosis unit 2A, when the OR gates 5A, 5B 
and 5C output simultaneously the signal of logic "1". 
When all of the latch circuits 42D, 42 E and 42F output 
the signal of logic "1 ", the diagnosis unit 2A 1 makes de- 
cision that abnormality is present in the majority decision 
circuit 10A, provided that the output of the latch circuit 
42G is logic "1 °, while deciding the absence of abnor- 
mality when the output of the latch circuit 42G is logic M 0\ 



When it is decided at the step 34 that the majority 
decision circuit 1 0A is operating normally, the procedure 
proceeds to a processing step 47. At this step 47, deci- 
sion is made as to whether all the output signals of the 
s latch circuits 42A, 42B and 42C (i.e. the signals 16A at 
the step 37) are logic n 0'. When the decision at the step 
47 results in "NO' (negative), the procedure proceeds to 
the processing at a step 35. Subsequently, the process- 
ings at the steps 32A, 46B, 37, 33A, 34A, 38 and 39 are 
*o executed sequentially. The processing at the step 46B 
is same as that of the step 46. When it is decided at the 
step 39 that there exists the signal 16A undergone no 
change, the procedure proceeds to the step 40. Other- 
wise, the procedure proceeds to the step 31. 

In case all the three signals 16A are decided to be 
logic "0" at a step 47, the CPU 25 outputs a load signal 
L Q (step 48). This load signal L 0 is supplied to the indi- 
vidual latch circuits of the latch device 41 A by way of the 
wiring conductor 45A. All of the latch circuits constituting 
the latch device 41 A fetch to store therein the associated 
detection signals 16A, 17A and 18A in response to the 
load signal L G as inputted. The latch circuit 42G fetches 
the output of the AND gate 43. Subsequently, the step 
32 is executed. The reason why the signals are forcibly 
fetched by the latch circuits in response to the load signal 
L 0 can be explained as follows. In order to decide wheth- 
er the individual logical components of the majority de- 
cision circuit 41 A operate normally or not even in the 
case where all of the three signals a, b and c are logic 
"0", the diagnosis unit 2A A fetches the outputs of the latch 
circuits 42A to 42H in response to the load signal L 0 . In 
other words, since the latch circuits 42A to 42H are 
cleared to the state of logic °0 n by the reset signal R,, the 
states stored in the latch circuits undergo no change so 
long as the detection signals 16A remain logic "0\ Ac- 
cordingly, there arises such possibility that the state 
where the outputs of all the latch circuits of the latch de- 
vice 41 A are logic "0* might be under the influence of the 
reset signal R, rather than the detection signals 16A of 
logic "0". Under the circumstances, through the forcive 
signal fetching by the latch circuits 42A to 42H in re- 
sponse to the load signal L^,, decision as to the presence 
or absence of abnormality in the majority decision circuit 
10A on the basis of the output of the individual latch cir- 
cuits cleared in response to the reset signal can be avoid- 
ed, while allowing the decision of the majority decision 
circuit 1 0A to be executed only when all of the three sig- 
nals 16A are logic "0 B . 

After execution of the step 32B, the steps 46 A, 33B 
and 34B are executed, wherein the same processings 
as those at the steps 46, 33 and 34 are performed. The 
processing at the step 47A is performed in the same 
manner as the step 47. When the result of the step 47A 
as executed is "YES", the processing starting from the 
step 48, inclusive thereof, is repeated. On the other 
hand, when the result of the decision made at the step 
47A is "NO", the procedure succeeding to the step 32A, 
inclusive thereof, is executed. 
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With the instant embodiment of the invention, similar 
advantageous effects to those of the embodiment shown 
in Fig. 1 can be obtained. Besides, by virtue of the pro- 
vision of the latch device capable of latching the outputs 
of the individual signal detectors, the test signals S out- 
putted asynchronously by the diagnosis units operating 
asynchronously can be fetched simultaneously. In other 
words, notwithstanding that the individual diagnosis 
units operate asynchronously, the abnormality decision 
of the given one of the majority decision circuits can be 
accomplished with high reliability on the basis of the test 
signals generated simultaneously through cooperation 
of the other diagnosis units. 

When a predetermined time required for the influ- 
ence of the clearing by the reset signal R, to become null 
(i.e. the time required for the signal of logic °0" or logic 
"1 n to be inputted to the latch circuit after the clearing) 
has elapsed in succession to the processing at the step 
46, the step 35 may then be executed. In this case, a 
series of processings at the steps 47 to 47A described 
above are rendered unnecessary, whereby the process- 
ing procedure can be correspondingly simplified. 

The signal detector 11 A and the latch circuit 42H 
may be spared by replacing the AND gate 6A by the 
wired logic AND gate as in the case of the embodiment 
shown in Fig. 1 . 

Fig. 14 illustrates the function of the diagnosis unit 
2At of the embodiment shown in Fig. 9. The diagnosis 
unit 2A^ representing functionally the diagnosis unit 2A, 
differs from the diagnosis unit 2A' illustrated in Fig. 8 in 
that the reset signal output means J 12, the signal (16 A) 
identifying means J13 for outputting the load signal L 0 
and the output means J14 are added to the diagnosis 
unit 2A' illustrated in Fig. 8. The diagnosis unit 2B n and 
2C, are equivalent to the diagnosis unit 2A/ with regard 
to the function. 

When each of the majority decision circuits 1 0A, 1 0B 
and 10C of the embodiment shown in Fig. 9 is replaced 
by the majority decision circuit :0A- l shown in Fig. 7, it is 
then required to construct each of the latch devices 41 A, 
41 B and 41 C in the structure of the latch device 49 shown 
in Fig. 1 5. This latch device 49 includes latch circuits 42I 
to 42K and AND gates 50A, 50B and 50C in place of the 
latch circuit 42G and the AND gate 43 in the latch device 
41 A. Operation or function of the latch device will be elu- 
cidated, assuming, by way of example, that the latch de- 
vice 49 is employed for the latch device 41 A. The AND 
gate 50A receives as the inputs thereto the output sig- 
nals of the signal detectors 7A and 8A. The AND gate 
SOB receives the output signals of the signal detectors 
8A and 9A. The AND gate 50C receives the output sig- 
nals of the signal detectors 7 A and 9 A. The output of the 
AND gate 50A is inputted to the latch circuit 42I. The out- 
put of the AND gate SOB is inputted to the latch circuit 
42J. The output of the AND gate 50C is inputted to the 
latch circuit 42K. On the other hand, the outputs of the 
latch circuits 42I to 42K are inputted to the diagnosis unit 
2A 1 . Further, the latch circuits 42! to 42K are supplied as 



other inputs thereto with the reset signal R, and the load 
signal L Q through the wiring conductors 44A and 45A. 
The latch circuits 42D, 42E, 42F are supplied as inputs 
thereto with the output signals of the signal detectors 
s 12A, 12B and 12C shown in Fig. 7, respectively. At the 
time point t 4 shown in Fig. 6, the signal a is logic "1 " while 
the signals b and c are logic "0". However, all of the latch 
circuits 42A, 42B and 42C store therein logic "1" at that 
time point t 4 . The latch circuits 42A to 42C output the 
10 respective signals of logic "T to the diagnosis unit 2A t 
at the time point T 4 . Consequently, the diagnosis unit 2A 1 
will decide that the AND gates 6B to 6C of the majority 
decision circuit 1 0A 1 suffer from abnormality. With a view 
to preventing such erroneous decision, there are provid- 
es ed the latch circuits 421 , 42H and 42K as well as the AND 
gates 50A, 50B and 50C similarly to the aforementioned 
latch circuit 42G and the AND gate 43. The diagnosis 
unit 2A, performs the abnormality decision for the ma- 
jority decision circuit '\0A< 1 on the presumption that the 
20 logic "0 B outputs of the latch circuits 42A and 42B are 
true when the output of the latch circuit 42I is logic "1 
the logic "1 ■ outputs from the latch circuits 42B and 42C 
are true when the output of the latch circuit 42J is logic 
"1 " and that the logic "1 B outputs of the latch circuits 42A 
25 and 42C are true when the output of the latch circuit K is 
logic "1". 

Another embodiment of the triplex control system 
according to the present invention will now be described 
by referring to Figs. 16, 17 and 18. Fig. 16 shows a con- 

30 trol apparatus 1 A 2 producing the signal a as the output 
thereof in association with a majority decision circuit 10A 
and a diagnosis unit 2A 3 . It will however be readily ap- 
preciated that the control apparatuses outputting the sig- 
nals b and c are also provided in association with the 

35 corresponding majority decision circuits and diagnosis 
units, respectively, in the same manner as shown in Fig. 
1 6. In the case of the instant embodiment, the output sig- 
nals to S n of the individual sensors are directly input- 
ted to the control apparatus 1 A2. 

40 Fig. 17 shows a hardware structure of the control 
apparatus 1 Ag. As will be seen in this figure, the control 
apparatus 1 A 2 includes a CPU 55B, a RAM 55C, a ROM 
55D, input circuits 55A and 55F, output circuits 55E and 
55G and a bus 55H for interconnecting these compo- 

45 nents. The control apparatuses 1 B2 and 1 C 2 are also im- 
plemented in the same structure. The diagnosis unit 2A 3 
shown in Fig. 18 is substantially identical with the diag- 
nosis unit 2A described hereinbefore in conjunction with 
Fig. 3. The diagnosis unit 2A 3 differs from the latter 2A 

50 in that external wiring conductors 3A and 75 are connect- 
ed to the output circuit 27 in the case of the diagnosis 
unit 2A 3 . 

The CPU 25 of the diagnosis unit 2A 3 executes the 
processing in accordance with the procedure illustrated 
55 in Fig. 20, while the CPU 55B of the control apparatus 
1 A 2 executes the processing procedure illustrated in Fig. 
1 9. The processing procedure of Fig. 20 is also executed 
by the other diagnosis unit as well. Similarly, the process- 
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ing procedure shown in Fig. 19 is also executed by the 
other control apparatuses. 

The CPU 25 of the diagnosis unit 2A 3 outputs a test 
command signal CH at a step 35A. This test command 
signal CH is inputted to the RAM 55C of the control ap- 
paratus 1 Ag by way of the wiring conductor 75. 

The CPU 55B of the control apparatus 1 Ag executes 
the processing of a step 59. More specifically, the CPU 
55B decides whether the test command signal CH has 
been inputted or not. Upon inputting of the test command 
signal CH, decision at the step 59 results in "YES" (af- 
firmative), being followed by the execution of a step 76. 
In other words, the pulse-like test signal including as al- 
ternate sequence of "0", "1° and "0" is outputted as the 
signal a. The time width or duration of the pulse-like test 
signal is represented by T Q as in the case of the embod- 
iment shown in Fig. 1. In succession to the outputting of 
this test signal, the test command signal CH stored in the 
RAM 55C is erased (step 67) for the purpose of prevent- 
ing the pulse-like test signal from being frequently out- 
putted under the command of the test command signal 
CH stored in the RAM 55C. When the sensor output sig- 
nals S-, to S n are inputted to the control apparatus 1 Ag, 
the CPU 55B executes the processing steps 60, 61 A, 
62A, 63 and 64. 

After execution of the step 35 A, the CPU 25 of the 
diagnosis unit 2A 3 executes the processing steps 32A, 
37, 33A, 34A, 38 and 39 described hereinbefore. Addi- 
tionally, the aforementioned step 36 or 40 may be exe- 
cuted, as occasion requires. 

According to the instant embodiment of the inven- 
tion, there can be obtained the effects similar to those of 
the embodiment shown in Fig. 1 . In particular, it must be 
pointed out that the probability of influence of failure at 
least in one of the CPU 55B of the control apparatus 1 Ag 
(i.e. function of the test signal generating means K2 
shown in Fig. 21 ), the CPU 25 of the diagnosis unit 2A 3 , 
the bus 30 and the output circuit 27 (i.e. functions of the 
test command signal output means J2, the counter J3 
and the output means J 1 0) to the device to the controlled 
is decreased. The diagnosis abnormality decision circuit 
J4 decides the abnormality in the test signal generating 
circuit K2, the test command signal outputting circuit J2, 
the counter J3 and the output circuit J10 on the basis of 
whether the test signal undergoes or not a change within 
a predetermined time duration. 

Fig. 21 shows a control apparatus 1 A 2 ' and a diag- 
nosis unit 2A 3 ' which represent functionally the control 
apparatus 1A 2 and the diagnosis unit 2A 3 , respectively. 
The other control apparatuses and diagnosis units per- 
form respective functions in the similar manner. The di- 
agnosis unit 2A 3 ' differs from the diagnosis unit 2A' 
shown in Fig. 8 in that the test signal generating means 
J1 and the output means J9 of the latter are omitted and 
that the controller abnormality decision means J15 is 
provided as in the case of the diagnosis unit 2A V The 
control means 1 Ag' includes a control signal generating 
means K1 (corresponding to steps 60, 61 A, 62A, 63 and 



64), a test signal generating means K2 (corresponding 
to a step 76) and a change-over means K3 (correspond- 
ing to a step 59). The test signal generating means K2 
receives as the input thereto the test command signal 

5 CH and outputs the test signal. The change-over means 
K3 performs the switching operation in response to the 
test command signal CH. The control apparatus or con- 
troller in each of the embodiments described hereinbe- 
fore includes the control signal generating means K1 . 

10 However, the test signal generating means K2 and the 
change-over means K3 are not incorporated. 

Fig. 22 shows still another embodiment of the triplex 
control system according to the invention. The triplex 
control system of the instant embodiment corresponds 

is to the system shown in Fig. 1 in which only one 10A of 
the three majority decision circuits 10A, 10B and 10C is 
employed. The device subject to the control is only one 
valve 1 3. The control apparatuses (controllers) 1 A, 1 B 
and 1 C are provided in one-to-one correspondence with 

20 the diagnosis units 2A, 2B and 2C, respectively. The de- 
tection signals 16A of the signal detectors 7A, 8A and 
9A provided on the input side of the majority decision 
circuit 10A, the detection signals 17 of the signal detec- 
tors 12A, 12B and 12C incorporated in the majority de- 

25 cision circuit 1 0A and the detection signal 1 8A of the sig- 
nal detector 1 1 A provided on the output side of the ma- 
jority decision circuit 10A are branched and inputted to 
the diagnosis units 2A, 2B and 2C, respectively. 

Each of the diagnosis units 2A to 2C executes the 

30 same processing as shown in Fig. 4. The instant embod- 
iment can equally provide the advantageous effects as 
in the case of the embodiment shown in Fig. 1 . 

In this manner, the teachings of the present inven- 
tion can be equally applied to the case where only one 

35 device is subject to the control. 

Parenthetically, it should be mentioned that in the 
embodiment shown in Fig. 19, the latch devices 41 A, 
41 B and 41 C may be provided similarly to the embodi- 
ment shown in Fig. 9. 

*o Next, a quadruplex control system according to a 
further embodiment of the present invention will be de- 
scribed by reference to Figs. 23, 24 and 25. The quad- 
ruplex control system is applied to a nuclear reactor pro- 
tection or safeguard system in a nuclear power plant. 

45 The arrangement of this control system is essentially 
identical with that of the system shown in Fig. 1 except 
that a control apparatus (controller) 1 D, a change-over 
switch SWD, a majority decision circuit 10 D 3 , a diagnosis 
unit 2D 7 , signal detectors 7D, 8D, 9D and 83A to 83D 

50 and wiring conductors 1 9D and 22 are additionally pro- 
vided because of the quadruplexing. Reference charac- 
ters 84A to 84D designate excitation coils for actuating 
valves 13A to 13D, respectively. Although the excitation 
coils 84A to 84D are shown separately from the associ- 

55 ated valves 1 3A to 1 3D in Figs. 23 and 24, is will readily 
be understood that they are assembled together in real- 
ity. The control apparatus 1 D is of the same structure as 
the apparatus 1 A, 1 B or 1 C and serves for the same f unc- 
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tion as the latter The change-over switch SWD serves 
for the same function as the switch SWA, SWB or SWC. 
The wiring conductor connected to the stationary contact 
4C of the change-over switch SWD is connected to the 
majority decision circuits 1 0A 3 to 1 0D 3 , respectively The 
signal detectors 83A, 83B, 83C and 83D detect the signal 
carried by the wiring conductor 1 9D on the input sides of 
the associated majority decision circuits, respectively. 
The signal detectors 7D, 8D and 9D detect the signal 
transmitted through the corresponding wiring conductors 
1 9 A to 1 9C on the input side of the majority decision cir- 
cuit 10D 3 similarly to the signal detectors 7 A, 8A and 9 A. 

Connected to the stationary contacts of the 
change-over switches SWA to SWD are the wiring con- 
ductors 82A to 82D. which are grounded, as is shown in 
Fig. 23. These wiring conductors 82A to 82D function as 
the test signal generating means for supplying the test 
signals S of logic "0" to the associated majority decision 
circuits, respectively, whenever the associated 
change-over switches assume the state in which the sta- 
tionary contacts 4B and 4C are connected to each other. 

Fig. 24 shows a structure of the majority decision 
circuits 10A 3 to 10D 3 each implemented in the form of a 
2-out-of-4 voting logic configuration. The majority deci- 
sion circuit 10A 3 includes relays (or contactors) 85A to 
85H constituting the switch means, signal detectors 86A 
to 86F, an AND gate 89 realized by a wired logic and 
wiring conductors 87A to 87D. The relays 85A, 85B and 
85C and 85D are disposed in series and interconnected 
by the wiring conductor 87A. The relay 85E, 85F, 85G 
and 85H are also disposed in series and mutually con- 
nected by the wiring conductor 87B. The wiring conduc- 
tor 87C connects the portion of the wiring conductor 87A 
located between the relays 85A and 85B and the portion 
of the wiring conductor 87 B located between the relays 
85E and 85F to each other. On the other hand, the wiring 
conductor 87D connects the portion of the wiring con- 
ductor 87A located between the relays 85B and 85C to 
the portion of the wiring conductor 87B located between 
the relays 85F and 85G. The wiring conductors 87A and 
87B are connected together and hence connected to a 
power supply source 88. The wiring conductor 87A has 
the other end connected to the other end of the wiring 
conductor 87B to thereby realize the AND gate 89 in the 
form of a wired logic. The AND gate 89 in turn is con- 
nected to the wiring conductor 20A. In the case of the 
instant embodiment, the wired logic AND gate 89 is pro- 
vided in each of the majority decision circuits 10A 3 to 
10D 3> whereby the necessity for providing the signal de- 
tectors 11 A to 1 1 C in the wiring conductors 20A to 20D, 
respectively, as in the case of the embodiment shown in 
Fig. 1 , is avoided. 

Now, description will be turned to the disposition of 
the signal detectors 86A to 86F within the majority deci- 
sion circuit 10A 3 . The signal detectors 86A to 86F are 
contactless sensors as with the case of the signal detec- 
tors 7 A to 9 A. The signal detector 86 A is provided for the 
wiring conductor 87A at a location between the junction 



of the wiring conductors 87C and 87 A and the relay 85 A. 
The signal detector 86B is provided for the wiring con- 
ductor 87 A at a location between the junction of the wir- 
ing conductors 87D and 87A and the relay 85B. The sig- 

s nal detector 86C is provided in association with the wiring 
conductor 87A between the relay 85D and the AND gate 
89. The signal detector 86E is provided in association 
with the wiring conductor 87B at a location between the 
junction of the wiring conductor 87C and 87B and the 

io relay 85E. The signal detector 86F is provided for the 
wiring conductor 87B at a location between the junction 
of the wiring conductors 87D and 87B and the relay 85F. 
The signal detector 86F is provided for the wiring con- 
ductor 87A at a location between the relay 85H and the 

is AND gate 89. 

The signal a is applied to the relay 85A and 85C by 
way of the wiring conductor 1 9A. The signal b is applied 
to the relays 85B and 85G through the wiring conductor 
19B. The signal c is applied to the relays 85E and 85D 

20 through the wiring conductor 1 9C. The signal d is applied 
to the relays 85F and 85H through the conductor 19D. 
Each of the relays 85A to 85H is opened when the as- 
sociated one of the signals a to d is logic °0" while being 
closed when the associated signal is logic "1 B . When two 

25 or more of the signals a to d assume the logic "0° level, 
connection of the excitation coil 84A to the power supply 
source 88 is broken by the opening of the contact of the 
associated relay, resulting in that the excitation coil 84A 
is brought to the deenergized state to open the valve 

30 1 3A. When three or more of the signals a to d assumes 
the logic "1 0 level, interconnection between the excitation 
coil 84A and the power supply source 88 is established 
by the associated relay contact being closed, whereby 
the excitation coil 84A is electrically energized to close 

35 the valve 13A. 

A 2-out-of-4 logic circuit corresponding to the struc- 
ture of the majority decision circuit 1 0A 3 in which the sig- 
nal detectors B6A to 86F are omitted is disclosed in a 
Japanese publication entitled "Handbook of Nuclear En- 

40 gineering" published by Ohm Sha Ltd. (Nov 30, 1976), 
p. 264, Table 9.6. The logic of the 2-out-of-4 logic circuit 
of this majority decision circuit is given by the following 
expression: 

2 - abc + bed + cda + dab (1 ) 

45 where Z represents the output of the AND gate 86, and 
a to d represent the values of the corresponding signals 
a tod. 

Each of the majority decision circuits 10A 3 to 10D 3 
is a sort of signal selecting device for selecting such a 

so signal from a plurality of input signals which is to operate 
the device subject to the control, to thereby output an 
actuation signal therefor similarly to the majority decision 
circuits 10A to 10C shown in Fig. 1 . However, the major- 
ity decision circuits 1 0A 3 to 1 0D 3 differ from the majority 

55 decision circuits 10A to 10C shown in Fig. 1 in that the 
signal selected from the four input signals (signals a to 
d) is not outputted intact as the actuation signal. In other 
words, in the case of the majority decision circuits ac- 
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cording to the instant embodiment of the invention, the 
relays 85A to 85H select the signal for operating the de- 
vice (e.g. valve) subject to the control, whereupon the 
signal differing from the selected input signal a, ... or d 
(e.g. current from the power supply source 88) is output- s 
ted as the actuation signal for the device under the con- 
trol. 

The detection signals detected by the signal detec- 
tors 86A to 86F are supplied to the input circuit 28 (Fig. 
25) of the diagnosis unit 2A 7 through separate wiring 10 
conductors. This input circuits 28 is also supplied with 
the detection signals of the signal detectors 7A to 9A and 
83A. In Figs. 23 and 24, the latter detection signals are 
collectively designated by I6A2 while the former detec- 
tion signals are collectively designated by 1 7 A^ Further, is 
reference characters 16B 2 to 16D 2 designate the detec- 
tion signals outputted from the signal detectors 7B to 9B, 
83B, 7C to 9C, 83C, 7D to 9D and 83D. Reference char- 
acters 17Bg to 17D 2 designate the detection signals of 
the signal detectors 89A to 86F in the majority decision 20 
circuits 10B 2 to 10D 2 . 

Each of the diagnosis units 2A 7 to 2D 7 is implement- 
ed in a structure shown in Fig. 25 and substantially iden- 
tical with the diagnosis unit 2 A shown in Fig. 3. 

The abnormality diagnosing function of the instant 25 
embodiment will be described below. The diagnosis units 
2A 7 to 2D 7 are each designed to perform the same func- 
tion. Accordingly, in the following, the contents of 
processing executed by the diagnosis unit 2A 7 will be 
elucidated, by way of example. The CPU 25 of the diag- 30 
nosis unit 2A 7 reads out the processing procedure illus- 
trated Fig. 26 from the ROM 42. At first, in a step 35A, 
the test command signal CH is outputted. In response to 
this test command signal CH, the change-over switch 
SWA change-overs the state in which the control appa- 35 
ratus 1 A is connected to the wiring conductor 1 9 A to the 
state where the wiring conductors 82A serving as the sig- 
nal generating means is connected to the conductor 1 9 A. 
As a consequence, the test signal S of logic "1° is trans- 
mitted to the wiring conductor 19A from the conductor 40 
82A. The control apparatus 1 A supplied with the sensor 
signal outputs the signal of logic °1" in the normal state 
where the valve 1 3A is held in the closed state. This sig- 
nal of logic "1 " is transferred to the wiring conductor 1 9A 
by way of the switch SWA so long as no test command 45 
signal CH is outputted. When the valve 13A is to be 
closed, the control apparatus 1A outputs the signal of 
logic "0". Since the diagnosis units 2A 7 to 2D 7 operate 
asynchronously with one another, the test signals S out- 
putted from the wiring conductors 82A to 82D to the cor- so 
responding wiring conductors 1 9A to 1 9D in response to 
the test command signal CH have such periods T 1 to T 4 
as illustrated in Fig. 27, respectively. These periods T 1 
to T 4 can be adjusted by the previously mentioned 
counters incorporated in the diagnosis units 2A 7 to 2D 7 . ss 
Upon interrupt of the output of the test command signal 
CH from the diagnosis unit 2A 7 , the signal of logic "1° 
outputted from the control apparatus 1 A is transmitted to 



the wiring conductor 1 9 similarly to the original state. The 
pulse width T 0 during which the signal of logic "0" is out- 
putted is so determined that the valve 1 3A is prevented 
from being actuated, as with the case of the duration T 0 
of the pulse-like ter* signal illustrated in Fig. 6 for the con- 
trol system shown in Fig. 1 . 

After the step 35A, the signals 16A 2 and 17A 2 are 
inputted to the CPU 25, the number of these input signals 
being counted (step 32B). At a step 37C, change in the 
four inputted signals 1 6A 2 is detected, wherein the signal 
1 6A 2 undergone the change is stored in the RAM 26. At 
a step 33H, the input signals 16A2 and 17Ag are com- 
pared with the normal signal patterns shown in Fig. 29. 
Subsequently, decision is made as to the presence or 
absence of abnormality in the majority decision circuit 
IOA3. Fig. 28 shows, listing in a table, the relays which 
can be detected individually by the signal detectors 86A 
to 86F. The signal detectors 86A to 86F are designed to 
detect the current. When the relay 85A, for example, is 
closed, a current flows through the signal detector 86 A. 
On the other hand, when the relay 85A is opened, no 
current flows through the signal detector 86A. Each sig- 
nal detector produces the output signal of logic "1 " when 
the current flows through the associated relay, while pro- 
ducing the output signal of logic "0" when no current 
flows through the associated relay. When the patterns of 
the input signals 16A2 and 17A2 differ from the normal 
signal patterns shown in Fig. 29, it is decided that the 
majority decision circuit 1 0A 3 suffers abnormality or mal- 
function, whereupon the processing at the step 36 is ex- 
ecuted. Discrepancy in the pattern resulting from the pat- 
tern comparison indicates that abnormality occurs in the 
associated relays listed in the rightmost column in the 
table shown in Fig. 29. Needless to say, the relays are 
logical elements constituting parts of the majority deci- 
sion circuit IOA3. 

When the decision at the step 34A results in the ab- 
sence of abnormality, decision is then made at a step 90 
whether breaking of wire occurs in the excitation coil 
84A. If the outputs of all the signal detectors 86A to 86F 
are logic "0" in the state where all the outputs of the signal 
detectors 7A to 9A and 83A are logic "1", it is then de- 
cided that breaking of wire takes place in the excitation 
coil 84A, being then followed by execution of the 
processing at the step 36. When the decision at the step 
90 results in "NO", a step 38 is executed whereupon the 
processing succeeding to the step 35A is repeated. On 
the other hand, when the result of decision made at the 
step 38 is "YES", the procedure proceeds to the process- 
ing of the step 39B, where decision is made as to the 
abnormality of another diagnosis unit in the manner sim- 
ilarly to the step 39 (Fig. 4). 

In the case of the instant embodiment, the latch de- 
vices described hereinbefore in conjunction with Fig. 9 
and 10 can be employed. 

The quadruplex control system according to the in- 
stant embodiment can bring about the similar advanta- 
geous effects to those of the system shown in Fig. 1. 
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However, when compared with the system shown in Fig. 
1 in which the function of the signal generating means is 
imparted to the microcomputer constituting the diagnosis 
unit 2 A or the system including the control apparatus 
connected in the manner shown in Fig. 16, the quadru- 
plex control system requires that the signal generating 
means be provided separately and independent of the 
diagnosis unit and the control apparatus, involving a 
structure complicated more or less as compared with the 
triplex control system on the whole. 

Fig. 30 is a view illustrating functionally the quadru- 
plex control system according to the instant embodi- 
ment. By way of example, the diagnosis unit 2A, can be 
functionally implemented as indicated by a block 2A/. 
This diagnosis unit 2A/ is substantially identical with the 
diagnosis unit 2A 3 ' shown in Fig. 21 with regard to the 
function. The former differs from the latter only in that the 
test signal generating means (the grounded wiring con- 
ductor 82A shown in Fig. 23) G and the change-over 
switch (change-over) SWA are provided externally of the 
control apparatus lAg, wherein the test command out- 
putted from the test command signal output means J2 is 
inputted to the change-over switch SWA rather than the 
test signal generating means G. In this connection, it 
should be appreciated that these functions of the test sig- 
nal generating means G and the change-over switch 
SWA of the diagnosis unit 2A' 7 can also be applied to 
the triplex control system described hereinbefore in con- 
junction with Fig. 1 and others. 

There is known a dual-solenoid type nuclear reactor 
protecting system having an enhanced reliability. In this 
system, a single valve 1 3A is provided with a pair of ex- 
citation coils 84A and 84A' so that the valve 13A is 
opened only when both the excitation coils are deener- 
gized, as is shown in Fig. 31 . The teaching of the present 
invention can equally be applied to the abnormality de- 
cision for a majority decision circuit 10A4 provided in as- 
sociation with the dual-solenoid valve, which circuit 1 0A4 
may then be composed of the majority decision circuit 
IOA3' having the same structure as the circuit 10A 3 . 

Further, the teaching of the present invention can be 
applied to a duplex control system as well. Besides, the 
invention can also be applied not only to a multiplexed 
control system designed to output analogue control sig- 
nals but also to a multiplex control system equipped with 
an intermediate value selecting circuit employed as the 
signal selector (corresponding to the majority decision 
circuits in the various systems described hereinbefore) 
to which the abovementioned control signal is applied. 
In this case, however, it is necessary to change the latch 
circuit (for example, Fig. 10; 41 A to 41 H) to a sam- 
ple-hold circuit receiving the input signals to determine 
any abnormality of the intermediate value selecting cir- 
cuit by comparing magnitude of the signals. 



Claims 

1 . A control system for controlling a device (13), com- 
prising: 

n control apparatuses (1A.1B.1C) each gener- 
ating a corresponding one of n control signals, 
n£3; 

n test signal generating means (J1 ,J2 I J3,82A, 
82B.82C.82D) provided respectively for each of 
the n control apparatuses (1A.1B.1C) installed 
in parallel with one another for diagnosis of an 
abnormality, the n test signal generating means 
(J1 , J2,J3,82A,82B,82C,82D) being arranged to 
periodically generate a corresponding one of n 
test signals and a corresponding one of n pulse 
test command signals, the periods for which the 
n test signal generating means (J1,J2,J3,82A 1 
82B,82C,82D) generate the test signals and the 
pulse test command signals being different for 
each of the test signal generating means (J 1 , J2, 
J3,82A,82B,82C,82D) the pulse test command 
signals having a duration during which the 
device (13) to be controlled can remain inoper- 
ative, the test signal generating means being 
arranged to operate asynchronously with each 
other; 

n change over switches, each change over 
switch acting in response to a corresponding 
one of the n pulse test command signals to out- 
put either the corresponding one of the n control 
signals from the corresponding one of the n con- 
trol apparatuses (1 A, 1 B, 1 C) or the correspond- 
ing one of the n test signals from the corre- 
sponding one of the n test signal generating 
means (J1,J2,J3,82A,82B,82C,82D); 
a signal selecting means (10A) receiving the n 
output signals from the n change over switches 
and being arranged to generate a majority sig- 
nal for operating the device (13) under control, 
said majority signal (18 A) representing a major- 
ity vote among the n output signals of the n 
change over switches ; and 
n diagnosis units (2A.2B.2C) for deciding the 
presence or absence of an abnormality in said 
signal selecting means (10A) on the basis of 
said n output signals of the n change over 
switches and said majority signal (18A). 

2. A control system for controlling n devices 
(13A.13B.13C), n > 3 comprising: 

n control apparatuses (1 A, 1 B, 1 C), each for gen- 
erating a corresponding one of n control signals 
for a corresponding one of the n devices 
(13A.13B.13C); 

n test signal generating means (J1 .J2.J3.82A, 
82B.82C.82D) provided respectively for each of 
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the n control apparatuses (1 A.1B.1C) installed 
in parallel with one another for diagnosis of an 
abnormality, the n test signal generating means 
(J1 t J2,J3,82A,82B,82C,82D) being arranged to 
periodically generate a respective one of n test s 
signals and a respective one of n pulse test 
command signals, the periods for which the n 
test signal generating means (J1,J2,J3 i 82A, 
82B.82C.82D) generate the test signals and the 
pulse test command signals being different for 10 
each of the test signal generating means 
(J1 1 J2,J3,82A I 828,82C,82D), the pulse test 
command signals having a duration during 
wh ich the devices ( 1 3A, 1 3B, 1 3C) to be control- 
led can remain inoperative, the test signal gen- is 
erating means being arranged to operate asyn- 
chronously with each other; 
n change over switches, each change over 
switch acting in response to a corresponding 
one of the n pulse test command signals to out- 20 
put either the corresponding one of the n control 
signals from the corresponding one of the n con- 
trol apparatuses (1 A,1 B.1C) or the correspond- 
ing one of the n test signals from the corre- 
sponding one of the n test signal generating 2s 
means (J1.J2.J3, 82^826,820,820); 
n signal selecting means (10A,10B,10C) each 
receiving the n output signals of the n change 
over switches and being arranged to generate 
a corresponding one of n majority signals 30 
(18A.20A) for operating a corresponding one of 
the n devices (13) under control, each of said 
majority signals (18A.20A) representing a 
majority vote among the n output signals of the 
change over switch; and 35 
n diagnosis units (2A.2B.2C), each for deciding 
the presence or absence of an abnormality in a 
corresponding one of said n signal selecting 
means (10A.10B.10C) on the basis of said n 
output signals of said n change over switches 40 
and said majority signal (18A, 20A) from the cor- 
responding one of the n signal selecting means 
(10A,10B,10C). 

3. A control system according to claim 1 or claim 2, 45 
wherein each of said n signal selecting means (10) 

is so arranged as to output an actuation signal for 
operating said device (13) under control, when a 
predetermined number of signals of those outputted 
from said plurality of control apparatuses (1 ) indicate so 
that said device(s) (13) under control is to be oper- 
ated. 

4. A control system according to any one of the pre- 
ceding claims, wherein each of said n control appa- ss 
ratus (1 A,1 B.1C) includes control signal generating 
means (K1) for outputting said corresponding con- 
trol signal on the basis of an output signal of a sensor 



and includes said corresponding one of said n test 
signal generating means (K2). 

5. A control system according to claims 1, 2, or 3, 
wherein each cf **<2id n diagnosis units (2) includes 
said corresponding one of n test signal generating 
means (J1.J2). 

6. A control system according to any one of the pre- 
ceding claims, wherein each of said n diagnosis 
units (2A.2B.2C) includes first abnormality decision 
means for deciding presence or absence of abnor- 
mality in said signal selecting means on the basis of 
the n output signals of the n change over switches 
and the majority signal and second abnormality 
decision means for deciding presence or absence 
of abnormality of the other diagnosis units by moni- 
toring the n output signals of said n change over 
switches. 

7. A control system according to any one of the pre- 
ceding claims, further including n latch devices (41) 
including memory means for storing the output sig- 
nals from the n change over switches which are 
inputted to said corresponding signal selecting 
means (10) and those of the corresponding majority 
signals outputted from said corresponding signal 
selecting means which have undergone a change. 

8. A control system according to claim 6, wherein each 
of said diagnosis means (2A) includes means for 
outputting a reset signal to said memory means of 
said corresponding latch device (41 ) upon reception 
of said output signals from the n change over 
switches and corresponding majority signal. 

9. A control system according to claim 4, wherein at 
least one signal selecting means includes n logical 
elements (5,85) for receiving n output signals of said 
n change over switches to generate said majority 
signal for operating the device(s) (1 3), and the sys- 
tem further including: 

n x n first signal detecting means (7,8,9) for 
detecting for each of said n diagnosis units each 
of said n output signals of the n change over 
switches; and 

n second signal detecting means (11,12) for 
detecting individually the corresponding one of 
n majority signals generated by said corre- 
sponding one of said n signal selecting means. 

Patentanspruche 

1. Steuersystem zum Steuern einer Vorrichtung (13) 
mit 
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n Steuergeraten (1 A, 1 B, 1 C), von denen jedes 
ein entsprechendes von n Steuersignalen, n > 
3, erzeugt; 

n Testsignal-Erzeugungseinrichtungen (J1 , J2, 
J3, 82A, 82B, 82C, 82D), die jeweils fur Jedes 5 
der n Steuergerate (1 A, 1 B. 1 C) vorhanden sind 
und die parallel zueinander installiert sind, urn 
Anomalitaten zu diagnostizieren, wobei diese 
Testsignal-Erzeugungseinrichtungen (J1, J2, 
J3, 82A, 82B, 82C, 82D) so ausgebildet sind, io 
daB sie periodisch ein entsprechendes der n 
Prufsignale und ein entsprechendes von n Im- 
pulstest-Befehlssignalen erzeugen, wobei die 
Perioden, fur die die Testsignal-Erzeugungsein- 
richtungen (J1 , J2, J3, 82A, 82B, 82C, 82D) die is 
Testsignale und die Impulstest-Befehlssignale 
erzeugen, fur jede der Testsignal-Erzeugungs- 
einrichtungen (J1 , J2, J3, 82A, 82B, 82C, 82D) 
voneinander verschieden sind und die Impuls- 
test-Befehlssignale eine Dauer aufweisen, in 20 
der die zu steuernde Vorrichtung (13) inaktiv 
bleiben kann, und wobei die Testsignal-Erzeu- 
gungseinrichtungen so ausgebildet sind, daft 
sie asynchron zueinander arbeiten; 
n Umschaltern, von denen jederauf ein entspre- 25 
chendes der n Impulstest-Befehlssignale hin so 
arbeitet, daB er entweder das entsprechende 
der n Steuersignale vom entsprechenden der n 
Steuergerate (1A, 1B, 1C) Oder das entspre- 
chende der n Testsignale von der entsprechen- 30 
den der n Testsignal-Erzeugungseinrichtungen 
(J1 , J2, J3, 82A, 82B, 82C, 82D) ausgibt; 
einer Signalauswahleinrichtung (10A), die die n 
Ausgangssignale von den n Umschaltern erhalt 
und so ausgebildet ist, daft sie ein Majoritatssi- 35 
gnal zum Betreiben der gesteuerten Vorrich- 
tung (13) aufweist, wobei dieses Majoritatssi- 
gnal (18A) die Majoritatswahl unter den n Aus- 
gangssignalen der n Umschalter reprasentiert; 
und 40 
n Diagnoseeinheiten (2A. 2B, 2C) zum Ent- 
scheiden auf das Vorliegen oder Fehlen einer 
Anomalitat in der SignalauswahlEinrichtung 
(10A) auf Grundlage der n Ausgangssignale der 
n Umschalter sowie des Majoritatssignals 45 
(18A). 

2. Steuersystem zum Steuern von n Vor richtungen 
(13A, 13B, 13C), n>3, mit: 

50 

n Steuergeraten (1 A, 1 B, 1 C), von denen jedes 
ein entsprechendes von n Steuersignalen fur 
eine entsprechende der n Vorrichtungen (13A, 
13B, 13C) erzeugt; 

n Testsignal-Erzeugungseinrichtungen (J1 , J2, ss 
J3, 82A, 82B, 82C, 82D), die jeweils fur jedes 
dern Steuergerate (1 A, "IB, 1 C) vorhanden sind 
und die parallel zueinander installiert sind, urn 



Anomalitaten zu diagnostizieren, wobei diese 
Testsignal-Erzeugungseinrichtungen (J1, J2, 
J3, 82A, 82B, 82C, 82D) so ausgebildet sind, 
daB sie periodisch ein entsprechendes der n 
Prufsignale und ein entsprechendes von n Im- 
pulstest-Befehlssignalen erzeugen, wobei die 
Perioden, fur die die Testsignal-Erzeugungsein- 
richtungen (J1 , J2, J3, 82A, 82B, 82C, 82D) die 
Testsignale und die Impulstest-Befehlssignale 
erzeugen, fur jede der Testsignal-Erzeugungs- 
einrichtungen (J1, J2, J3, 82A, 82B, 82C, 82D) 
voneinander verschieden sind und die Impuls- 
test-Befehlssignale eine Dauer aufweisen, in 
der die zu steuernde Vorrichtung (13) inaktiv 
bleiben kann, und wobei die Testsignal-Erzeu- 
gungseinrichtungen so ausgebildet sind, daB 
sie asynchron zueinander arbeiten; 
n Umschaltern, von denen jeder auf ein entspre- 
chendes dern Impulstest-Befehlssignale hin so 
arbeitet, daB er entweder das entsprechende 
der n Steuersignale vom entsprechenden der n 
Steuergerate (1A, 1B, 1C) oder das entspre- 
chende der n Testsignale von der entsprechen- 
den der n Testsignal-Erzeugungseinrichtungen 
(J1 , J2, J3, 82A, 82B, 82C, 82D) ausgibt; 
n Signalauswahleinrichtungen (10A, 10B, 10C), 
von denen jede die n Ausgangssignale der n 
Umschalter erhalt und so ausgebildet ist, daB 
sie ein entsprechendes von n Major itatssigna- 
len (18A, 20A) zum Betreiben einer entspre- 
chenden der n gesteuerten Vorrichtungen (13) 
erzeugt, wobei jedes der Majoritatssignale 
(18A, 20A) die Majoritatswahl unter den n Aus- 
gangssignalen der Umschalter reprasentiert; 
und 

n Diagnoseeinheiten (2A, 2B, 2C), von denen 
jede dazu dient, auf das Vorliegen oder Fehlen 
einer Anomalitat in einer entsprechenden der n 
Signalauswahleinrichtungen (10A, 10B, 10C) 
auf Grundlage der n Ausgangssignale der n 
Umschalter und des Majoritatssignals (18A, 
20A) von der entsprechenden der n Signalaus- 
wahleinrichtungen (10 A, 10B, 10C)zuentschei- 
den. 

Steuersystem nach Anspruch 1 und Anspruch 2, bei 
dem jede der n Signalauswahlauswahlein rich- 
tungen (10) so ausgebildet ist, daB sie ein Betati- 
gungssignal zum Betreiben der gesteuerten Vorrich- 
tung (13) ausgibt, wenn eine vorgegebene Anzahl 
von Signalen, wie sie von den mehreren Steuerge- 
raten (1) ausgegeben werden, anzeigt, daB die 
gesteuerte(n) Vorrichtung(en) (13) zu betreiben ist 
(sind). 

Steuersystem nach einem der vorstehenden 
Anspruche, bei dem jedes der n Steuergerate (1A, 
1B, 1C) eine Steuersignal-Erzeugungseinrichtung 
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(K1) zum Ausgeben des entsprechenden Steuersi- 
gnats auf Grundiage eines Ausgangssignals eines 
Sensors aufweist, und sie die entsprechende der n 
Testsignal-Erzeugungseinrichtungen (K2) aufweist. 

5 

5. Steuersystem nach einem der AnsprOche 1 , 2 Oder 
3, bei dem jede der n Diagnoseeinheiten (2) die ent- 
sprechende der n Testsignal-Erzeugungseinrichtun- 
gen (J1 , J2) enthalt. 

w 

6. Steuersystem nach einem der vorstehenden 
AnsprOche, bei dem jede der n Diagnoseeinheiten 
(2A, 2B, 2C) eine erste Anomalitatsentscheidungs- 
einrichtung zum Entscheiden auf das Vorliegen oder 
Fehlen von Anomalitat in der Signalauswahleinrich- is 
tung auf Grundiage der n Ausgangssignale der n 
Umschalter und des Majoritatssignals, und eine 
zweite Anomalitatsentscheidungseinrichtung zum 
Entscheiden auf das Vorliegen Oder Fehlen von 
Anomalitat der anderen Diagnoseeinheiten durch 20 
Uberwachen der n Ausgangssignale der n Umschal- 
ter aufweist. 

7. Steuersystem nach einem der vorstehenden 
AnsprOche, ferner mit n Zwischenspeicher-Einrich- 25 
tungen (41) mit einer Speichereinrichtung zum 
Abspeichern der Ausgangssignale der n Umschal- 
ter, wie sie in die entsprechende Signalauswahlein- 
richtung (10) eingegeben werden, und derjenigen 
der entsprechenden Majoritatssignale, wie sie von 30 
der entsprechenden Signalauswahleinrichtung aus- 
gegeben werden, die eine Anderung erfahren hat. 

8. Steuersystem nach Anspruch 6, bei dem jede der 
Diagnoseeinrichtungen (2A) eine Einrichtung zum 35 
Ausgeben eines Rucksetzsignals an die Speicher- 
einrichtung der entsprechenden Zwischenspei- 
cher-Einrichtung (41 ) bei Empfang der Ausgangssi- 
gnale von den n Umschaltern und dem entsprechen- 
den Majoritatssignal aufweist. 40 

9. Steuersystem nach Anspruch 4, bei dem minde- 
stens eine Signalauswahleinrichtung n Logikele- 
mente (5, 85) enthalt, um die n Ausgangssignale der 
n Umschalter zu empfangen, um das Majoritatssi- 45 
gnal zum Betreiben der Vorrichtung(en) (13) zu 
erzeugen, und das System femer folgendes auf- 
weist: 

n x n erste Signalerfassungseinrichtungen (7, 8, so 
9) zum Erfassen jedes der n Ausgangssignale 
der n Umschalter fur jede dem Diagnoseeinhei- 
ten; und 

n zweite Signalerfassungseinrichtungen (11, 
12) zum individuellen Erfassen des entspre- 55 
chenden der n Majoritatssignale, wie es von der 
entsprechenden der n Signalauswahleinrich- 
tungen erzeugt wird. 2. 



Revendications 

1 . Systeme de commande pour commander un dispo- 
sitif (13), comportant : 

n dispositifs de commande (1 A, 1 B, 1 C) engen- 
drant chacun un signal correspondant parmi n 
signaux de commande, n > 3 ; 
n moyens engendrant un signal d'essai (J1 , J2, 
J3, 82A, 82B, 82C, 82D) agences respective- 
ment pour chacun des n dispositifs de com- 
mande (1A, 1B, 1C) installes en parallele tes 
uns avec les autres pour diagnostiquer une ano- 
malie, les n moyens engendrant un signal 
d'essai (J1, J2, J3, 82A, 82B, 82C, 82D) 6tant 
agences pour engendrer de maniere p6riodique 
un signal correspondant parmi les n signaux 
d'essai et un signal correspondant parmi n 
signaux impulsionnels destruction d'essai, les 
periodes pendant lesquelles les n moyens 
engendrant un signal d'essai (J1, J2, J3, 82A, 
82B, 82C, 82D) engendrent les signaux d'essai 
et les signaux impulsionnels d'essai etant diffe- 
rentes pour chacun des moyens engendrant un 
signal d'essai (J1, J2, J3, 82A, 82B, 82C, 82D) 
les signaux impulsionnels d'instruction d'essai 
ayant une duree pendant laquelle le dispositif 
(13) a commander peut rester inactif, les 
moyens engendrant un signal d'essai 6tant 
agences pour agir de maniere asynchrone les 
uns par rapport aux autres, 
n commutateurs inverse urs, chaque commuta- 
teur inverseur agissant en reponse a un signal 
correspondant parmi ies n signaux impulsion- 
nels d'instruction d'essai pour emettre soit le 
signal correspondant parmi les n signaux de 
commande provenant du dispositif correspon- 
dant parmi les n dispositifs de commande (1 A, 
1 B, 1 C) soit le signal correspondant parmi les n 
signaux d'essai provenant d'un moyen corres- 
pondant parmi les n moyens engendrant un 
signal d'essai (J1 , J2, J3, 82A, 82B, 82C, 82D), 
des moyens (10A) de selection de signal rece- 
vant les n signaux emis provenant des n com- 
mutateurs inverseurs et etant agences pour 
engendrer un signal de majorite pour actionner 
le dispositif (1 3) sous commande, (edit signal de 
majorite (18A) representant une decision de 
majorite parmi les n signaux emis par les n com- 
mutateurs inverseurs, et 

n unites de diagnostic (2A, 2B, 2C) pour decider 
de la presence ou de Pabsence d'une anomalie 
dans lesdits moyens de selection de signal 
(1 OA) sur la base desdits n signaux emis par les 
n commutateurs inverseurs et dudit signal de 
majorite (18A). 

Systeme de commande pour commander n dispo- 
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sitifs (13A, 13B, 13C), n > 3, comportant : 

n dispositifs de commande (1 A, 1B, 1C) desti- 
nes chacun a engendrer un signal correspon- 
dant parmi n signaux de commande pour un dis- s 
positif correspondant parmi les n dispositifs 
(13A, 13B, 13C), 

n moyens engendrant un signal d'essai (J1, J2, 
J3, 82A, 82B, 82C, 82D) agences respective- 
ment pour chacun des n dispositifs de com- 10 
mande (1A, 1B, 1C) instailes parallelement les 
uns aux autres pour diagnostiquer une anoma- 
lie, les n moyens engendrant un signal d'essai 
(J1 , J2, J3, 82A, 82B, 82C, 82D) etant agences 
pour engendrer periodiquement un signal res- is 
pectif parmi n signaux d'essai et un signal impul- 
sionnel respectif parmi n impulsionnels signaux 
d'instruction d'essai, les periodes pendant les- 
quelles les n moyens engendrant un signal 
d'essai (J1 , J2, J3, 82A, 82B, 82C, 82D) engen- 20 
drent les signaux d'essai et les signaux impul- 
sionnels d'instruction d'essai etant differentes 
pour chacun des moyens engendrant un signal 
d'essai (J1, J2, J3, 82A, 82B, 82C, 82D) les 
signaux impulsionnels d'instruction d'essai 25 
ayant une duree pendant laquelle les dispositifs 
(13A, 13B, 13C) a commander peuvent rester 
inactifs, les moyens engendrant un signal 
d'essai etant agences pour agir de maniere 
asynchrone les uns par rapport aux autres, 30 
n commutateurs inverseurs, chaque commuta- 
teur inverseur agissant en reponse a un signal 
impulsionnel correspondant parmi les n signaux 
impulsionnels d'instruction d'essai pour emettre 
soit le signal correspondant parmi les n signaux 35 
de commande provenant du dispositif corres- 
pondant parmi les n dispositifs de commande 
(1 A, 1 B, 1C) soit le signal correspondant parmi 
les n signaux d'essai provenant d'un moyen cor- 
respondant parmi les n moyens engendrant un 40 
signal d'essai (J1 , J2, J3, 82A, 82B, 82C, 82D), 
n moyens de selection de signal (10A, 10B, 
10C) recevant chacun les n signaux emis par 
les n commutateurs inverseurs et etant agences 
pour engendrer un signal correspondant parmi 45 
n signaux de majorite (18A, 20 A) pour faire agir 
un dispositif correspondant parmi les n disposi- 
tifs (13) sous commande, chacun desdits 
signaux de majorite (18A, 20A)) representant 
une decision de majorite parmi les n signaux so 
emis par les commutateurs inverseurs, et 
n unites de diagnostic (2A, 2B, 2C), chacune 
etant destinee a decider de la presence ou de 
I'absence cf une anomalie dans un moyen cor- 
respondant parmi lesdits n moyens de selection ss 
de signal (10A, 10B, 10C)) sur fa base desdits 
n signaux emis par lesdits n commutateurs 
inverseurs et dudit signal de majorite (1 8A. 20A) 



provenant d'un moyen correspondant parmi les 
n moyens de selection de signal (10A, 10B, 
10C). 

3. System e de commande selon la revendication 1 ou 
2, dans lequel chacun desdits n moyens de selection 
de signal (10) est agence de maniere a emettre un 
signal d'actionnement pour faire agir ledrt dispositif 
(13) sous commande, lorsqu'un nombre predeter- 
mine de signaux parmi ceux emis en provenance 
desdits plusieurs dispositifs de commande (1) indi- 
que que ledrt dispositif ou lesdits dispositifs (13) 
sous commande doivent etre actionnes. 

4. Systeme de commande selon Tune quelconque des 
revendication precedentes, dans lequel chacun 
desdits n dispositifs de commande (1A, 1B, 1C) 
comporte des moyens (K1) engendrant un signal de 
commande destines a emettre ledit signal de com- 
mande correspondant sur la base d'un signal emis 
par un detecteur et comporte ledit moyen correspon- 
dant parmi lesdits n moyens engendrant un signal 
d'essai (K2). 

5. Systeme de commande selon la revendication 1 , 2 
ou 3, dans lequel chacune desdites n unites de dia- 
gnostic (2) comporte un moyen correspondant 
parmi les n moyens engendrant un signal d'essai 
(J1.J2). 

6. Systeme de commande selon I'une quelconque des 
revendications precedentes, dans lequel chacune 
desdites n unites de diagnostic (2A, 2B, 2C) com- 
porte des premiers moyens de decision d'anomalie 
destines a decider de la presence ou de I'absence 
d'une anomalie dans lesdits moyens de selection de 
signal sur la base des n signaux emis par les n com- 
mutateurs inverseurs et du signal de majorite et des 
seconds moyens de decision d'anomalie pour deci- 
der de la presence ou de I'absence d'une anomalie 
des autres unites de diagnostic en gerant les n 
signaux emis par lesdits n commutateurs inver- 
seurs. 

7. Systeme de commande selon I'une quelconque des 
revendications precedentes, comportant en outre n 
dispositifs de verrouillage (41) comportant des 
moyens de memoire pour memoriser les signaux 
emis par les n commutateurs inverseurs qui sont 
introduits dans lesdits moyens de selection de signal 
correspondants (1 0) et ceux des signaux de majorite 
correspondants emis par lesdits moyens de selec- 
tion de signal correspondants qui ont subi un chan- 
gement. 

8. Systeme de commande selon la revendication 6, 
dans lequel chacun desdits moyens de diagnostic 
(2 A) comporte des moyens pour emettre un signal 
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de remise a z6ro vers lesdits moyens de mSmoire 
dudit dispositif de verrouillage correspondant (41) 
lors de la reception desdits signaux emis par les n 
commutateurs inverseurs et du signal de majorite 
correspondant. s 

Systeme de commande selon la revendication 4, 
dans lequel au moins un des moyens de selection 
de signal comporte n elements logiques (5, 85) pour 
recevoir n signaux emis par lesdits n commutateurs 10 
inverseurs pour engendrer ledit signal de majorite 
pour actionner le ou les dispositifs (13), et le sys- 
teme comporte en outre : 

n x n premiers moyens de detection de signal 15 
(7, 8, 9) pour detecter pour chacune desdites n 
unit6s de diagnostic, chacun desdits n signaux 
emis par les n commutateurs inverseurs, et 
n seconds moyens de detection de signal (11, 
12) pour detecter un signal de majorite corres- 20 
pondant de maniere individuelle parmi les n 
signaux de majorite engendres par ledit un 
moyen de selection correspondant parmi lesdits 
moyens de selection de signal. 

25 



30 



40 



45 



SO 



21 



EP 0 307 191 B1 



FIG. I 




2A 
i 

DIAGNOSIS 
UNIT 



3A 

_L_ 



23 
, i , 

a 



~I7A 

5 = 



MAJORITY 
DECISION 



9A t 
_^2B 



H8A 

20A 
1 



i 



"A _ 

I0A |3A 
3B 



DIAGNOSIS 
UNIT 

T 



} 1 



I7B 



MAJORITY 
DECISION 



2C 



MOB 



DIAGNOSIS 
UNIT 



H8B 
20B 

IIB 1 ^ 
3C, ' 3B 



; r i7c 



MAJORITY 
DECISION 



SWC 



T 



M8C 
,20C 



IOC IIC ^130 



22 



EP 0 307 191 B1 



FIG. 2 



I9A-^ 



I9B 



I9C- 7 



5/T I2A 



J7A 



I OA 



/ 



,20A 




2IA 



22A^- 
3A 



24 



27 



G. 


3 








25 




26 


ROM 




CPU 





RAM 



OUTPUT 



28 



INPUT 



I6A- 



-I7A 



23 



EP 0 307 191 B1 



FIG. 4 



1 



OUTPUTTING OF TEST SIGNAL "0" AND I 31 

TEST COMMAND SIGNAL 01 

* ~ 



FETCHING OF SIGNALS I6A TO 
ISA AS INPUT SIGNALS 



-32 



COMPARISON OF INPUT SIGNALS I6A TO 
I8A WITH PATTERN SHOWN IN FIG. 5 



34 



I 



-33 



DECISION OF ABNORMALITY IN 
MAJORITY DECISION CIRCUIT 



] NORMAL 



ABNORMAL 



OUTPUTTING OF TEST S GN AL "0" -» "I "— "0 ' 
AND TEST COMMAND SIGNAL 



1 



35 



THESE SIGNALS ARFINPIJTffiT 



1 



36 



DISPLAY OF CONTENTS 
OF ABNORMALITY AND 
GENERATION OF ALARM 



-32A 



DETECTION OF CHANGE IN THREE 
SIGNALS I6A AND STORAGE OF THE 
SIGNAL UNDERGONE CHANGE 



COMPARISON OF INPUT SIGNALS I6A 
AND I8A WITH PATTERNS SHOWN IN 
FIG. 5 



I 



NO 



DECISION OF ABNORMALITY IN 
MAJORITY DECISI ON CIRCUI T 

♦NORMAL 



'37 



-33 A 



ABNORMAL 



THE NUMBER OF INPUT TIMES HAS 
ATTAINED A PRESET VALUE ? 



ABSENT 



♦YES 



DECISION AS TO WHETHER SIGNAL 
I6A REMAINING UNCHANGED EXISTS 
AMONG THREE SIGN ALS I6A 

r- 

39 



-34 A 
-38 



PRESENT 



.40 



DISPLAY OF ABNOMAUTY 
OF DIAGNOSIS UNIT OUT- 
PUTTING TEST SIGNAL 
REMAINING UNCHANGED 



24 



EP 0 307 191 B1 



FIG. 5 



• 1 

No 


INPUTS TO MA- 
JORITY DECI- 
SION CIRCUIT 


OUTPUTS OF LOGICAL ELEMENTS 
OF MAJORITY DECISION CIRCUIT 


a 


b 


c 


OUTPUT OF 
DETECTOR 
l?A 


OUTPUT OF 
DETECTOR 
I2B 


OUTPUT OF 
DETECTOR 
I2C 


OUTPUT OF 
DETECTOR 
ISA 


1 


0 


0 


0 


0 


0 


0 


0 


2 


0 


0 


1 


0 


1 


1 


0 


3 


0 


1 


0 




1 


0 


0 


4 


0 


1 


1 




1 




1 


5 


1 


0 


0 




0 




0 


6 


1 


0 


1 




1 




1 


7 


1 


1 


0 




1 




1 


8 


1 


1 


1 




1 




1 



FIG. 6 



To 



SIGNAL a _ Tt§ TL§ I V S n 

SIGNAL b § 



signal c ! ^ T3 ~~ n£f nif_,,_nd 

TIME AXIS -j j 1 1 H 1 — 

to t| t2 t3 t4 



25 



EP 0 307 191 B1 



FIG. 7 



I9A 



a 



6B jj 
I2A 



I7A 



IOA 



I^C- 7 [ L^6D H2C I 



20A 



Fl G. 8 



J4- 
JIO^ J2v 



PULSE 
GENERATING! 



I 



2IA 



22A 

V4l0UTPUT 



COUNTER 



TEST 
COMMAND 
SIGNAL 
GENERATING 



X 



TEST 
OUTPUT W SIGNAL 

GENERATING 

J? 



^ 2A' 



J6 



ABNORMALITY 
DECISION MEANS I 
FOR DIAGNOSIS 
UNIT 



ABNORMALITY 
DECISION FOR 
MAJORITY DECI- 
SION CIRCUIT 



I 



Jll 
_Jl_ 



OUTPUT 



K-3C 
3B 



-3A 



MEMORY[~J7 

— r 



^J5 



J8 



INPUT 




rl7A 



MAJORITY 
DECISION 



V 



-I8A 



.20 A 



I IA 



IOA 



M3A 



26 



EP 0 307 191 B1 



FIG. 9 



2IA- 



IA 



CON- 
TROLLER 



22A 
fc= 



44A-I 
45A 



DIAGNOSIS 
UNIT 



3A 
_i_ 



23 

Q 
3" 



W-I6A H7A 



V 

I9A 



SWA 



2IB 
22B 



IB 




LATCH DEVICE 
6A| 



n 



MAJORITY 
DECISION 



44B 
45B 



CON- 
TROLLER 








\ 



1 



2B 



DIAGNOSIS 
UNIT 



H8A 

,4IA 

-I8A1 
20A 

IA S 
3B 

L_ 



m-!6B M7B H 8B 



SWB 



I9B 




LATCH DEVICE 

i6Bi pgr 



7 



-4IB 



MAJORITY 
DECISION 



2G 



IOB 



hl8Bi 
,20B 



n 

,B be 




DIAGNOSIS 
UNIT 



3C 



2_ 



W-I6C Ej7C 



LATCH DEVICE 

I6C1 p7Cj 



MAJORITY 
DECISION 

1 

IOC 



I — I8C 

J — 4IC 

~ I8C, 
f20C 

U 

IC N3C 



27 



EP 0 307 191 B1 



FIG. 10 



I6A- 



45A- 



Lof 



44A ^i 
42A- 



42B 



ISA i 



I7Ai 




-I8Ai 



FIG. II 



22A 
2IA^_ 



44A^ 

4! 




24 



OUTPUT 



— r~ 

27A 





25^ 


26-s 




ROM 




CPU 




RAM 




,2Ai 



JL 



ror 



3A' 



28- 



30A 



INPUT 



29 ^30 



I6A- 



;U7A 



-I8A 



28 



EP0 307 191 B1 



FIG. 12 



* 

GENERATION OF TEST SIGNAL "0" 
AND TEST COMMAND SIGNAL 

I 



-31 



FETCHING OF SIGNALS I6A 
TO I8A AS INPUTS 



—32 



APPLICATION OF RESET 

SIGNAL Rl 

t 



— 46 



COMPARISON OF INPUT SIGNALS 
I6A TO I8A WITH PATTERNS SHOWN 

IN FIGJ5 



—33 



NO 



b 



DECISION OF ABNORMALITY FOR 
MAJORITY DECISION CIRCUIT 

I NORMAL " 



ABNORMAL 



THREE SIGNALS I6A 

"0" ? 



ARE 



YES 



GENERATION OF LOAD 
SIGNAL Lo 



I 



47 
-48 



36 



DISPLAY OF CONTENT 
OF ABNORMALITY 
AND GENERATION 
OF ALARM 



FETCHING OF SIGNALS I6A _^QR 
TO I8A AS INPUTS wCD 



T 



APPLICATION OF RESET 

SIGNAL Rl 

k 



— 46A 



COMPARISON OF INPUT SIGNALS 
I6A TO I8A WITH PATTERNS SHOWN 
IN FIG. 5 



© 



— 33 B 



29 



EP 0 307 191 B1 



FIG. 13 




® 



1 



34B 

!l_ 

decision of abnormality for 
majority decision circuit 



j NORMAL 



ABNORMAL 



THREE SIGNALS I6A ARE 

"0" ? 



•47A 



NO 



GENERATION OF TEST SGNAL"0"— T— "CT 
ANO TEST COMMAND SIGNAL 



-35 



FETCHING OF SIGNALS I6A 
T0I8A AS INPUTS 



-32A 



APPLICATION OF RESET 
SIGNAL Rl 

T 



~46B 



DETECTION OF CHANGE IN THREE 
SIGNALS I6A AND STORAGE OF SIGNAL 
I6A UNDERGONE CHANGE 



I 



—37 



COMPARISON OF INPUT SIGNALS 
I6A TO I8A WITH PATTERNS SHOWN 
IN FIG. 5 



-33A 



DECISION OF ABNORMALITY FOR 
MAJORITY DECISION CIRCUIT 



NO 



t NORMAL 



ABNORMAL 



ABSENT 



JTHE NUMBER OF SIGNAL FETCHINGS 
HAS ATTAINED A PRESET VALUE ? 

jYES 



-34A 
38 



DECISION AS TO WHETHER SIGNAL 
REMAINING UNCHANGED EXISTS 
AMONG THREE SIGNALS 



S 

39 



PRESENT 



1 



49 
_i_ 



DISPLAY OF ABNORMALITY 
OF OIAGNOSIS UNIT 
OUTPUTTING TEST SIGNAL 
REMAINING UNCHANGED 



30 



EPO 307 191 B1 



FIG. 14 



2AL 



J4 
_Jl_ 



PULSE 
GENERATOR 



J3 



JO 



J2 



COUNTER 



OUTPUT 



"1 



TEST 
COMMAND 
SIGNAL 
GENERATING! 



OUTPUT 



TEST 
SIGNAL 
GENERATING 



23- 



J6 
± 



□ 

3B-ttt~3C 



ABNORMALITY 
DECISION FOR 
DIAGNOSIS 
UNIT 



ABNORMALITY 
DECISION FOR 
rl MAJORITY 
DECISION 



~3A 



OUTPUT 



-Jll 



SIGNAL ( I6A) 
CHECKING 



■J5 

I/J13 



J7 
J 



MEMORY 



JI2 

\ 



RESET 
SIGNAL 
GENERATING 



4 



INPUT 




I6A 



-I7A H8A 



JI4 
Ju 



OUTPUT 



LATCH 



44A 



45A 



I6A1 Ll7Ai trISAi 



MAJORITY 
DECISION 

\6a 



20A 



t" 

IIA 



4 

I3A 



31 



EP 0 307 191 B1 




FIG. I 6 



53A| 



53Ni 



75~ 



2A 3 



DIAGNOSIS UNIT 
T 



CON- 
TROLLER 



"T" 

IA 2 



I9B 




23 



3A 



r |7A 



MAJORITY 
DECISION 



bc x !9C 



T" 

I OA 



3B 

H8A 



□ 



II 



I3A 



32 



EP 0 307 191 B1 



FIG. 1 7 



55F ,75 



INPUT 

55A 



55H 
_L__ 

Hcpu 



55E 
_J 

OUTPUT 



RAM 



ROM 



-55B 

N-55C 
-55D 



T 



IA 2 



FIG. 18 



27 



OUTPUT 



28 



24 
L 



RQM| 



25 
i_ 



CPU 



INPUT 



RAMI 

3^ 



TJ 



I6A- 



30 



I7A I8A 



33 



EP 0 307 191 B1 



FIG. 19 



< 



i 59 
I L_ 

TEST COMMAND CH IS RECEIVED ? 



Tno" 



FETCHING OF ALL DATA Si 
TO Sn AS MEASUREO 

* 



~60 



COMPARISON OF DATA 
Si TO Sn WITH 
PRESCRIBED VALUE 



I 



61 A 



62A 



ANY OF DATA EXCEEDS 
PRESCRIBED VALUE ? 



1N0 



SETTING OF 
OUTPUT SIGNAL 



fl. T0"0' 



E 



-63 



76 



OUTPUTTING OF 
PULSES "O n ~T-"0" 
(TEST SIGNAL) AS 
OUTPUT SIGNAL 0. 



64 

1 



SETTING OF OUTPUT 
SIGNAL S. T0"1" 



RESET OF INPUT TEST 
COMMAND CH 

l 



~67A 



34 



EPO 307 191 B1 



FIG. 20 



35A 
Jl 



GENERATION OF TEST 
COMMAND SIGNAL CH 



FETCHING OF SIGNALS I6A 
TO 18 A AS INPUTS 



I 



36 

i 

DISPLAY OF CONTENT 
OF ABNORMALITY 
AND GENERATION 
OF ALARM 



-32A 



DETECTION OF CHANGE IN THREE 
SIGNALS I6A AND STORAGE OF 
SIGNAL I6A UNDERGONE CHANGE 



COMPARISON OF INPUT SIGNALS 
I6A TO I8A WITH PATTERNS 
SHOWN IN FIG. 5 



-37 



^33A 



DECISION OF ABNORMALITY FOR 
MAJORITY DECISION CIRCUIT 



ABNORMAL 



NORMAL 



NO 



THE NUMBER OF SIGNAL 
FETCHINGS HAS ATTAINED A 
PRESET VALUE ? 



-34A 

-38 



YES 



JL 



39 



ABSENT 



DECISION AS TO WHETHER SIGNAL 
REMAINING UNCHANGED EXISTS 
AMONG THREE SIGNALS 16 A 



PESENT 



40 



DISPLAY OF 
ABNORMALITY OF 
DIAGNOSIS UNIT 

UNCHANGED 



35 



EP 0 307 191 B1 



FIG. 2 1 



,2*1 



J4 
_L_ 



PULSE 
GENERATOR 



J3 



JIO 
_L_ 



J2 



I 



OUTPUT 



K2 



COUNTER 

T= 



TEST 
J COMMAND 
M SIGNAL 
GENERATING 



23- 



J6 3A- 

- j 

ABNORMALITY 
DECISION FOR 
DIAGNOSIS UNIT 



IKS 



ABNORMALITY 
DECISION FOR 
MAJORITY DE- 
SION CIRCUIT 



T 



-Jll 



OUTPUT 



MEMORY 



I 



}-J7 



\J5 



J8 



TEST 

SIGNAL 

GENERATING 



CONTROL 

SIGNAL 

GENERATING 



T 



INPUT 
I 




I7A- 



I8A- 



MAJORITY 
DECISION 



IOA 



2C& 



IA 



Kl 



IA2 



36 



EP 0 307 191 B1 



FIG. 22 



22 A - 



IA 

JL 



CON- 
TROLLER 



2A 

_J 

DIAGNOSIS 



2IB^ 
22B- 



^SWA 



I8A 



I6A 

I9A 



I7A 



DIAGNOSIS 



I6A I7A 



I8A 



I7A 




5 ► 



5= ;^ 



MAJORITY 
DECISION 



-I8A 



I9C7A 

RA 

2C 



IOA 



IIA 



IC 




I8A 



CON- 
TROLLER 








— r 



•I9C 



swc 



37 



EP 0 307 191 B1 



FIG. 23 



IA 

L_ 

CON- 
TROLLER 



82A 



4B 



22A 
\ 



I6A2- 



IB 

i 

CON- 
TROLLER 



IC 

L_ 

CON- 
TROLLER 



ID 



CON- 
TROLLER 



4A 
22B 



4C 



SWA 

a 
T 

ISA 



± 

DIAGNOSIS 

TT 



23-4 
3/\ 



1 — 




SIX 



82B 




z 



SAc^ 



£ 



MAJORITY 

DECISION 



I7A2 
£|OA3 

"~20A 



83A ( 2B 7 



84A^ 



I3A 



DIAGNOSIS 



( 3B 



-I7B2 

(IO B3 



MAJORITY 
DECISION 



9B 83B (2C 7 



SWC 



DIAGNOSIS 




(3C 



20B 
I3B 




8C~Z 



H7C 2 
J!_nPC3 



MAJORITY 
DECISION 



20C 



9C 83C (2LV 




7 

84C 



22D~ 




DIAGNOSIS 



(3D 



r 

I3C 



I7D2 



i jjOD3 

84Dt$i 



MAJORITY 
DECISION 



,20D 



SWD 



83D 



S 

I3D 



38 



EP 0 307 191 B1 



FIG. 24 




lOAa- 



20A 84A 



FIG. 25 



24- 



ROM 




CPU 




RAM 



2Az 




39 



EP 0 307 191 B1 



FIG. 26 



NO 



ABSENT 



35A 

_L_ 



GENERATION OF TEST 
COMMANO SIGNAL CH 

I 



FETCHING OF SIGNALS I6A2 TO I7A2 
AND COUNTING THE NUMBER OF 
SIGNAL FETCHINGS 



36 



DISPLAY OF CONTENT! 
OF ABNORMALITY 
AND GENERATION 
OF ALARM 



DETECTION OF CHANGE IN FOUR 
SIGNALS 16 A2 AND STORAGE OF 
SIGNAL I6A2 UNDERGONE CHANGE 



-37C 



COMPARISON OF INPUT SIGNALS 
I6A2 TO I7A2 WITH FW7ERNS 

SHOWN IN FI G. 27 



~33H 



DECISION OF ABNORMALITY FOR 
MAJORITY DECISION CIRCUIT 



I N O RM AL 



ABNORMAL 



— 34A 



BREAKING OF WIRE IN 
EXCITATION COIL ? 



TNO 



YES 



-90 



THE NUMBER OF SIGNAL FETCHINGS 
HAS ATTAINED A PRESET VALUE ? 



Tyes" 



DECISION AS TO WHETHER SIGNAL 
IGA2 REMAINING UNCHANGED EXISTS 
AMONG FOUR SIGNALS I6A2 



39B 



-38 



PRESENT 



40 



DISPLAY OF 
ABNORMALITY OF 
DIAGNOSIS UNIT 
OUTPUTTING TEST 



40 



EPO 307 191 B1 



FIG. 27 



SIGNAL Q - J ! ] y y- 

h- — Jo — h — H-To 

SIGNAL b [| y U 

signal c s J*~ T3 ^[ l y y— 

SIGNAL d gd =J m U U 



FIG. 28 



SIGNAL DETECTORS 


DETECTION 
SIGNALS 


DE- 
TECTABLE 
RELAYS 


SIGNAL DETECTORS 86 A 


a 


85A 


SIGNAL DETECTORS 86B 


b 


85 B 


SIGNAL DETECTORS 86C 


a c 


85C,85D 


SIGNAL DETECTORS 86D 


C 


85E 


SIGNAL DETECTORS 86E 


d 


85F 


SIGNAL DETECTORS 86F 


bd 


85G,85H 



41 



EP0 307 191 B1 



FIG. 29 



SIGNALS I7A2 ( OUTPUT OF DETECTORS 86A~86F) 


DETECTABLE 
RELAYS 


DE~ 

TECTOR 
86 A 


DE~ 

TECTOR 
86 B 


TECTOR 
86 C 


TECTOR 
86 D 


DE- 
TECTOR 

86 E 


TECTOR 
86F 


I 


I 


I 


I 


I 


I 


85A-85H 


0 


I 


0 


I 


I 


I 


85A, 85C 


I 


0 


I 


i i 


I 


0 


85B, 85G 


I 


I 


0 


0 


I 


I 


85D, 85E 


I 


I 


I 


i 


0 


0 


85F, 85H 


0 


0 


0 


0 


0 


0 


odA, 85C 
85F! 85H 


0 


0 


0 


0 


0 


o 


85A, 85C 
85D, 85E 


0 


0 


0 


0 


0 


0 


85A 85C 
85G 


0 


0 


0 


0 


0 


0 


85B 
85F-85H 


0 


0 


0 


0 


0 


0 


Qcn Qcpi 

85E. 85G 


0 


0 


0 


0 


0 


0 


85D-85F 
85H 


0 


0 


0 


0 


0 


0 


85C-85F 
85A. 85H 


0 


0 


0 


0 


0 


0 


85A-85C 
85F-85H 


0 


0 


0 


0 


0 


0 


85A-85E 
85G 


0 


0 


0 


0 


0 


0 


85B 
85D-85H 


0 


0 


o 


0 


0 


0 


85A-85H 



EP 0 307 191 B1 



FIG. 30 



2 A?' 



J4 
_L_ 



PULSE 
GENERATOR 



J3 



v 



JIO 
__L_ 



I 



OUTPUT 



G 



COUNTER 



TEST 
COMMAND 
SIGNAL 
GENERATING 



tj2 



22A 



23- 



J6 



3A- 
3B' 



ABNORMALITY 
j-j DECISION FOR 
DIAGNOSIS UNIT 



ABNORMALITY 
DECISION FOR 
MAJORITY DE- 
CISION CIRCUIT 



T 



IE 



3D 
3C 



OUTPUT 



— Jll 



-J5 



MEMORY 



-J7 



J8 



INPUT 



V 



TEST 

SIGNAL 

GENERATING 



CONTROLLER 



T" 

IA 



I9B 



I6A~* 




~I7A 2 



MAJORITY 
DECISION 



20A 



83A 



IOA 




I3A 



43 



EP 0 307 191 B1 



FIG. 3 1 



88 

x 



1. 



,l7Aa 88 ' 

it 



.I7A 2 



b2=: 

I0A 3 84A 

r 



T 



10A4 



10A3 v 



I3A~ 



44 



